finding and fixing vulnerabilities in information systems vulnerability the assessment … ·...

TheVulnerability

Assessment &

MitigationMethodology

Finding and Fixing Vulnerabilities in Information Systems

Philip S. Antón

Robert H. Anderson

Richard Mesic

Michael Scheiern

Prepared for the Defense Advanced Research Projects Agency

R

National Defense Research Institute

Approved for public release; distribution unlimited

Report Documentation Page Form ApprovedOMB No. 0704-0188

Public reporting burden for the collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering andmaintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information,including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, ArlingtonVA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to a penalty for failing to comply with a collection of information if itdoes not display a currently valid OMB control number.

1. REPORT DATE 2003 2. REPORT TYPE

3. DATES COVERED 00-00-2003 to 00-00-2003

4. TITLE AND SUBTITLE The Vulnerability Assessment & Mitigation Methodology

5a. CONTRACT NUMBER

5b. GRANT NUMBER

5c. PROGRAM ELEMENT NUMBER

6. AUTHOR(S) 5d. PROJECT NUMBER

5e. TASK NUMBER

5f. WORK UNIT NUMBER

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) National Defense Research Institute,1776 main Street,PO Box 2138,Santa Monica,CA,90407

8. PERFORMING ORGANIZATIONREPORT NUMBER

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSOR/MONITOR’S ACRONYM(S)

11. SPONSOR/MONITOR’S REPORT NUMBER(S)

12. DISTRIBUTION/AVAILABILITY STATEMENT Approved for public release; distribution unlimited

13. SUPPLEMENTARY NOTES

14. ABSTRACT see report

15. SUBJECT TERMS

16. SECURITY CLASSIFICATION OF: 17. LIMITATION OF ABSTRACT

18. NUMBEROF PAGES

134

19a. NAME OFRESPONSIBLE PERSON

a. REPORT unclassified

b. ABSTRACT unclassified

c. THIS PAGE unclassified

Standard Form 298 (Rev. 8-98) Prescribed by ANSI Std Z39-18

The research described in this report was sponsored by the Defense AdvancedResearch Projects Agency. The research was conducted in RAND’s National DefenseResearch Institute, a federally funded research and development center supportedby the Office of the Secretary of Defense, the Joint Staff, the unified commands, andthe defense agencies under Contract DASW01-01-C-0004.

RAND is a nonprofit institution that helps improve policy and decisionmakingthrough research and analysis. RAND® is a registered trademark. RAND’s pub-lications do not necessarily reflect the opinions or policies of its research sponsors.

Published 2003 by RAND1700 Main Street, P.O. Box 2138, Santa Monica, CA 90407-2138

1200 South Hayes Street, Arlington, VA 22202-5050201 North Craig Street, Suite 202, Pittsburgh, PA 15213-1516

RAND URL: http://www.rand.org/To order RAND documents or to obtain additional information, contact Distribution

Services: Telephone: (310) 451-7002; Fax: (310) 451-6915; Email: [email protected]

© Copyright 2003 RAND

All rights reserved. No part of this book may be reproduced in any form by anyelectronic or mechanical means (including photocopying, recording, or informationstorage and retrieval) without permission in writing from RAND.

Library of Congress Cataloging-in-Publication Data

Finding and fixing vulnerabilities in information systems : the vulnerability assessment and mitigation methodology / Philip S. Anton ... [et al.].

p. cm.“MR-1601.”ISBN 0-8330-3434-0 (pbk.)1. Computer security. 2. Data protection. 3. Risk assessment. I. Anton, Philip S.

QA76.9.A25F525 2003005.8—dc21

2003012342

Cover design by Barbara Angell Caslon

iii

PREFACE

Vulnerability assessment methodologies for information systems have been weakestin their ability to guide the evaluator through a determination of the critical vulner-abilities and to identify appropriate security mitigation techniques to consider forthese vulnerabilities. The Vulnerability Assessment and Mitigation (VAM) methodol-ogy attempts to fill this gap, building on and expanding the earlier RAND methodol-ogy used to secure a system’s minimum essential information infrastructure (MEII).The VAM methodology uses a relatively comprehensive taxonomy of top-downattributes that lead to vulnerabilities, and it maps these vulnerability attributes to arelatively comprehensive list of mitigation approaches. The breadth of mitigationtechniques includes not only the common and direct approaches normally thoughtof (which may not be under one’s purview) but also the range of indirect approachesthat can reduce risk. This approach helps the evaluator to think beyond known vul-nerabilities and develop a list of current and potential concerns to head off surpriseattacks.

This report should be of interest to individuals or teams (either independent of orwithin the organization under study) involved in assessing and mitigating the risksand vulnerabilities of information systems critical to an organization’s functions—including the discovery of vulnerabilities that have not yet been exploited or encoun-tered. The report may also be of interest to persons involved in other aspects ofinformation operations, including exploitation and attack.

This report refers to, in multiple places, a prototype spreadsheet that implements themethodology using Microsoft Excel 2000. Readers may obtain a copy of this spread-sheet online at www.rand.org/publications/MR/MR1601/.

Unpublished RAND research by the authors of this report explored the issues inapplying VAM methodology to military tactical information systems. This researchmay be available to authorized government individuals by contacting Philip Antón([email protected]) or Robert Anderson ([email protected]).

This study was sponsored by the Information Technology Office (ITO) of the DefenseAdvanced Research Projects Agency (DARPA). It was conducted in the Acquisitionand Technology Policy Center of RAND’s National Defense Research Institute, a fed-erally funded research and development center (FFRDC) sponsored by the Office ofthe Secretary of Defense, the Joint Staff, the unified commands, and the defenseagencies.

v

CONTENTS

Preface ..................................................... iii

Figures ..................................................... ix

Tables...................................................... xi

Summary ................................................... xv

Acknowledgments............................................. xxiii

Acronyms ................................................... xxv

Chapter OneINTRODUCTION .......................................... 1Who Should Use the VAM Methodology? ......................... 1Previous Research.......................................... 2Structure of This Report...................................... 3

Chapter TwoCONCEPTS AND DEFINITIONS ............................... 5Security ................................................. 5Information Systems........................................ 5System Object Types ........................................ 5

On the Use of the “Object” Concept ........................... 6Attributes as Sources of Vulnerabilities .......................... 6

Security Techniques....................................... 7

Chapter ThreeVAM METHODOLOGY AND OTHER DoD PRACTICES IN RISKASSESSMENT ............................................. 9Overview of the VAM Methodology ............................. 9

Step 1. Identify Essential Information Functions .................. 10Step 2. Identify Essential Information Systems ................... 11Step 3. Identify System Vulnerabilities ......................... 12Step 4. Identify Pertinent Security Techniques from Candidates

Given by the VAM Methodology ............................ 15Step 5. Select and Apply Security Techniques .................... 16Step 6. Test for Robustness Under Threat ....................... 17

Other DoD Vulnerability Assessment Methodologies ................ 18

vi Finding and Fixing Vulnerabilities in Information Systems: VAM Methodology

OCTAVE ............................................... 19ISO/IEC 15408: Common Criteria............................. 19ISO/IEC 17799: Code of Practice for Information

Security Management ................................... 20Operations Security ....................................... 21Operational Risk Management ............................... 22Integrated Vulnerability Assessments .......................... 22The VAM Methodology Techniques Fill Critical Needs in

Other Methodologies .................................... 23

Chapter FourVULNERABILITY ATTRIBUTES OF SYSTEM OBJECTS ............... 25Vulnerability Attribute Categories .............................. 25A Vulnerability Checklist and Example........................... 25

Insider Threat ........................................... 25Inability to Handle Distributed Denial-of-Service Attacks ........... 26IP Spoofing ............................................. 26Inability to Detect Changes to IP Net, Making IP Masking Possible .... 29Centralized Network Operations Centers ....................... 29Common Commercial Software and Hardware Are Well Known

and Predictable ........................................ 29Standardized Software ..................................... 29Weaknesses in Router or Desktop Applications Software ............ 30Electronic Environmental Tolerances.......................... 30

Description of Vulnerability Attributes........................... 30Design and Architecture Attributes............................ 30Behavioral Attributes ...................................... 32General Attributes ........................................ 32

How Vulnerability Properties Combine in Common Threats........... 33

Chapter FiveDIRECT AND INDIRECT SECURITY TECHNIQUES ................. 37Security Technique Categories and Examples...................... 37

Resilience and Robustness .................................. 37Intelligence, Surveillance, Reconnaissance, and

Self-Awareness ........................................ 42Counterintelligence; Denial of ISR and Target Acquisition........... 43Deterrence and Punishment ................................ 43

How Security Techniques Combine in CommonSecurity Approaches .................................... 44

Chapter SixGENERATING SECURITY OPTIONS FOR VULNERABILITIES .......... 49Mapping Vulnerabilities to Security Techniques.................... 49

Security Techniques That Address Vulnerabilities ................. 49Security Techniques That Incur Vulnerabilities................... 51Vulnerability Properties Can Sometimes Facilitate

Security Techniques..................................... 52

Contents vii

Striking a Balance ........................................ 52Design and Usage Considerations ............................ 53

Refining the Security Suggestions .............................. 53Evaluator Job Roles ....................................... 54Attack Components ....................................... 56Attack Stage Relevance by Evaluator Job Role .................... 57

Example Security Options Arising from the Use of the Methodology ..... 59Insider Threat ........................................... 59Inability to Handle Distributed Denial-of-Service Attacks ........... 61IP Spoofing ............................................. 62Inability to Detect Changes to IP Net, Making IP Masking Possible .... 63Centralized Network Operations Centers ....................... 63Common Commercial Software and Hardware Are Well Known

and Predictable ........................................ 64Standardized Software ..................................... 65Weaknesses in Router or Desktop Applications Software ............ 65Electronic Environmental Tolerances.......................... 66

Chapter SevenAUTOMATING AND EXECUTING THE METHODOLOGY:A SPREADSHEET TOOL...................................... 69Initial Steps Performed Manually............................... 69Vulnerabilities Guided by and Recorded on a Form ................. 70The Risk Assessment and Mitigation Selection Spreadsheet ........... 70

Specifying the User Type and Vulnerability to Be Analyzed .......... 70Evaluating the Risks for Each Attack Component ................. 73Considering and Selecting Mitigations ......................... 75Rating Costs and the Mitigated Risks .......................... 76

Chapter EightNEXT STEPS AND DISCUSSION ............................... 79Future Challenges and Opportunities ........................... 79

Guiding the Evaluation of Critical Functions and Systems ........... 79Additional Guidance and Automation: Spreadsheet and

Web-Based Implementations.............................. 79Prioritizing Security Options ................................ 80Quantitative Assessments of Threats, Risks, and Mitigations ......... 80Integrating VAM Functions into Other

Assessment Methodologies ............................... 80Using VAM to Guide Information Attacks ....................... 81Applications of VAM Beyond Information Systems ................ 81

What Vulnerability Will Fail or Be Attacked Next? ................... 81Usability Issues............................................ 81Why Perform Security Assessments? ............................ 82

Chapter NineSUMMARY AND CONCLUSIONS .............................. 83

viii Finding and Fixing Vulnerabilities in Information Systems: VAM Methodology

AppendixVULNERABILITY TO MITIGATION MAP VALUES ..................... 85

Bibliography................................................. 115

ix

FIGURES

S.1. Security Mitigation Techniques ............................. xviiiS.2. The Concept of Mapping Vulnerabilities to Security Mitigation

Techniques............................................ xixS.3. Values Relating Vulnerabilities to Security Techniques ............ xixS.4. User and Attack Component Filtering in the VAM Tool............ xx3.1. Example Functional Decomposition of JFACC Information

Functions ............................................. 113.2. Example Information Systems Supporting the JFACC

Information Functions ................................... 123.3. Identifying Which Vulnerabilities Apply to the Critical System ...... 153.4. The Concept of Mapping Vulnerabilities to Security Mitigation

Techniques............................................ 163.5. Identifying Security Techniques to Consider ................... 173.6. Test the Revised System Against (Simulated) Threats ............. 183.7. The Core of the VAM Methodology Can Be Used in Other

Traditional Methodologies ................................ 234.1. Properties Leading to Vulnerabilities ......................... 264.2. Vulnerabilities Enabling Distributed Denial of Service ............ 344.3. Vulnerabilities Enabling Firewall Penetrations .................. 344.4. Vulnerabilities Enabling Network Mapping .................... 354.5. Vulnerabilities Enabling Trojan Horse Attacks .................. 365.1. Categories of Security Mitigation Techniques................... 385.2. Security Techniques Supporting INFOCONs ................... 455.3. Security Techniques Supporting I&W ........................ 455.4. Security Techniques Supporting CERTs ....................... 465.5. Security Techniques Used in Firewalls ........................ 475.6. Security Technique Incorporating Encryption and PKIs ........... 475.7. Security Technique Incorporating Isolation of Systems ........... 486.1. Values Relating Vulnerabilities to Security Techniques ............ 517.1. The VAM Methodology Spreadsheet Tool...................... 717.2. Specifying the User Type and Vulnerability to Be Analyzed ........ 727.3. Evaluating the Risks for Each Attack Component ................ 737.4. Considering and Selecting Mitigations........................ 757.5. Rating Costs and the Mitigated Risks ......................... 76

xi

TABLES

S.1. The Vulnerability Matrix .................................. xvii3.1. Vulnerability Matrix: Attributes of Information System Objects...... 134.1. Matrix of Vulnerability Attributes and System Object Types ........ 274.2. Example Completed Vulnerability Checklist.................... 286.1. The Vulnerability to Security Technique Matrix ................. 506.2. Resilience and Robustness Techniques for Evaluator Job Roles

and Attack Components .................................. 556.3. ISR, CI, and Deterrence Techniques for Evaluator Job Roles and

Attack Components...................................... 566.4. Methods for Accomplishing Each Component of an Attack......... 586.5. Vulnerability Exploitation by Attack Component ................ 60A.1. Mitigation Techniques That Address Singularity................. 86A.2. Mitigation Techniques That Address Uniqueness................ 87A.3. Mitigation Techniques That Address or Are Facilitated

by Centrality........................................... 88A.4. Mitigation Techniques That Address or Are Facilitated

by Homogeneity ........................................ 89A.5. Mitigation Techniques That Address or Are Facilitated

by Separability ......................................... 90A.6. Mitigation Techniques That Address Logic or Implementation

Errors, Fallibility ........................................ 91A.7. Mitigation Techniques That Address or Are Facilitated by Design

Sensitivity, Fragility, Limits, or Finiteness ..................... 92A.8. Mitigation Techniques That Address Unrecoverability ............ 93A.9. Mitigation Techniques That Address Behavioral Sensitivity

or Fragility ............................................ 94A.10. Mitigation Techniques That Address Malevolence ............... 95A.11. Mitigation Techniques That Address Rigidity ................... 96A.12. Mitigation Techniques That Address Malleability ................ 97A.13. Mitigation Techniques that Address Gullibility, Deceivability,

or Naiveté............................................. 98A.14. Mitigation Techniques That Address Complacency .............. 99A.15. Mitigation Techniques That Address Corruptibility

or Controllability........................................ 100A.16. Mitigation Techniques That Address Accessible, Detectable,

Identifiable, Transparent, or Interceptable..................... 101

xii Finding and Fixing Vulnerabilities in Information Systems: VAM Methodology

A.17. Mitigation Techniques That Address Hard to Manage or Control .... 102A.18. Mitigation Techniques That Address Self-Unawareness

or Unpredictability ...................................... 103A.19. Mitigation Techniques That Address or Are Facilitated

by Predictability ........................................ 103A.20. Vulnerabilities That Can Be Incurred from Heterogeneity.......... 105A.21. Vulnerabilities That Can Be Incurred from Redundancy ........... 105A.22. Vulnerabilities That Can Be Incurred from Centralization.......... 105A.23. Vulnerabilities That Can Be Incurred from Decentralization ........ 106A.24. Vulnerabilities That Can Be Incurred from VV&A,

Software/Hardware Engineering, Evaluations, Testing ............ 106A.25. Vulnerabilities That Can Be Incurred from Control of Exposure,

Access, and Output ...................................... 107A.26. Vulnerabilities That Can Be Incurred from Trust Learning and

Enforcement Systems .................................... 107A.27. Vulnerabilities That Can Be Incurred from Non-Repudiation ....... 108A.28. Vulnerabilities That Can Be Incurred from Hardening ............ 108A.29. Vulnerabilities That Can Be Incurred from Fault, Uncertainty,

Validity, and Quality Tolerance and Graceful Degradation ......... 108A.30. Vulnerabilities That Can Be Incurred from Static

Resource Allocation...................................... 108A.31. Vulnerabilities That Can Be Incurred from Dynamic

Resource Allocation...................................... 109A.32. Vulnerabilities That Can Be Incurred from

General Management .................................... 109A.33. Vulnerabilities That Can Be Incurred from Threat Response

Structures and Plans ..................................... 110A.34. Vulnerabilities That Can Be Incurred from Rapid Reconstitution

and Recovery .......................................... 111A.35. Vulnerabilities That Can Be Incurred from Adaptability

and Learning........................................... 111A.36. Vulnerabilities That Can Be Incurred from Immunological

Defense Systems........................................ 111A.37. Vulnerabilities That Can Be Incurred from Vaccination ........... 112A.38. Vulnerabilities That Can Be Incurred from

Intelligence Operations................................... 112A.39. Vulnerabilities That Can Be Incurred from Self-Awareness,

Monitoring, and Assessments .............................. 112A.40. Vulnerabilities That Can Be Incurred from Deception for ISR ....... 112A.41. Vulnerabilities That Can Be Incurred from Attack Detection,

Recognition, Damage Assessment, and Forensics (Self and Foe) ..... 113A.42. Vulnerabilities That Can Be Incurred from

General Counterintelligence ............................... 113A.43. Vulnerabilities That Can Be Incurred from Unpredictable

to Adversary ........................................... 113A.44. Vulnerabilities That Can Be Incurred from Deception for CI ........ 113A.45. Vulnerabilities That Can Be Incurred from Deterrence ............ 114

Tables xiii

A.46. Vulnerabilities That Can Be Incurred from Criminal and LegalPenalties and Guarantees ................................. 114

A.47. Vulnerabilities That Can Be Incurred from Law Enforcement;Civil Proceedings........................................ 114

xv

SUMMARY

As information systems become increasingly important to the functions of organiza-tions, security and reliable operation of these systems are also becoming increasinglyimportant. Interoperability, information sharing, collaboration, design imperfec-tions, limitations, and the like lead to vulnerabilities that can endanger informationsystem security and operation. Unfortunately, understanding an organization’sreliance on information systems, the vulnerabilities of these systems, and how tomitigate the vulnerabilities has been a daunting challenge, especially for less well-known or even unknown vulnerabilities that do not have a history of being exploited.

RAND has developed and evolved a methodology to help an analyst understandthese relationships, facilitate the identification or discovery of system vulnerabilities,and suggest relevant mitigation techniques. This Vulnerability Assessment and Miti-gation (VAM) methodology builds on earlier work by Anderson et al. (1999) and fills amuch-needed gap in existing approaches by guiding a comprehensive review of vul-nerabilities across all aspects of information systems (including not only cyberobjects but also physical, human/social, and infrastructure objects1) and mappingthe vulnerabilities to specific security techniques that can address them.

The VAM methodology takes a top-down approach and seeks to uncover not onlyvulnerabilities that are known and exploited or revealed today but also the vulner-abilities that exist yet have not been exploited or encountered during operation.Thus, the methodology helps to protect against future threats or system failureswhile mitigating current and past threats and weaknesses. Also, sophisticated adver-saries are always searching for new ways to attack unprotected resources (the “softunderbelly” of the information systems). Thus, the methodology can be valuable as away to hedge and balance both current and future threats. Also, the complexity ofinformation systems, and their increasing integration with organizational functions,requires additional considerations to ensure that design or architectural weaknessesare mitigated.

______________ 1An “object” is any part of the system that contributes to the function, execution, or management of thesystem. The partitioning of information system components into conceptual “objects” facilitates theconsideration of components that can otherwise be neglected in security assessments (i.e., securitybreaches can arise from weaknesses in physical security, human limits and behavior, social engineering,or compromised infrastructure in addition to the more publicized compromises, such as network attacks).It also allows the separation of vulnerability attributes from the system component that may have thatattribute.

xvi Finding and Fixing Vulnerabilities in Information Systems: VAM Methodology

MAPPING SECURITY NEEDS TO CRITICAL ORGANIZATIONALFUNCTIONS

The methodology employs the following six steps:

1. Identify your organization’s essential information functions.

2. Identify essential information systems that implement these functions.

3. Identify vulnerabilities of these systems.

4. Identify pertinent security techniques to mitigate these vulnerabilities.

5. Select and apply techniques based on constraints, costs, and benefits.

6. Test for robustness and actual feasibilities under threat.

Repeat steps 3–6 as needed.

The methodology’s guiding principles are the links back through critical systems toimportant organizational functions as well as assessments of the appropriateness ofsecurity techniques in each specific situation. This approach not only guides theevaluator through the myriad possible security techniques selections but also pro-vides management rigor, prioritization, and justification for the resources needed,helping others to understand what needs to be done and why.

IDENTIFYING WELL-KNOWN AND NEW VULNERABILITIES

Vulnerabilities arise from the fundamental properties of objects. The VAM method-ology exploits this fact to provide a relatively comprehensive taxonomy of propertiesacross all object types, leading the evaluator through the taxonomy by using a tableof properties applied to physical, cyber, human/social, and infrastructure objects (seeTable S.1). This approach helps the evaluator avoid merely listing the standard, well-known vulnerabilities (a bottom-up, historical approach), but asks questions outsidethe range of vulnerabilities commonly identified. For example, vulnerabilities arisenot only from such access points as holes in firewalls but also from such behavioralattributes as gullibilities or rigidities. These attributes may be exhibited by all types ofsystem components: cyber, physical, human/social, or infrastructure.

IDENTIFYING AND DOWNSELECTING MITIGATIONS TO IMPLEMENT

The VAM methodology identifies a relatively comprehensive taxonomy of securitytechnique categories to prevent, detect, and mitigate compromises and weaknessesin information systems (see Figure S.1). These techniques are grouped by techniquesthat improve system resilience and robustness; techniques that improve intelligence,surveillance, and reconnaissance (ISR) and self-awareness; techniques for counterin-telligence and denial of ISR and target acquisition; and techniques for deterrence andpunishment.

Summary xvii

Table S.1

The Vulnerability Matrix

RANDMR1601-tableS.1

Hardware (data storage,input/output, clients,

servers), network andcommunications, locality

Software, data,information, knowledge

Staff, command,management, policies,procedures, training,

authentication

Ship, building, power,water, air, environment

Behavioral sensitivity/fragility

Malevolence

Rigidity

Malleability

Gullibility/deceivability/naiveté

Complacency

Separability

Logic/implementationerrors; fallibility

Design sensitivity/fragility/limits/finiteness

Unrecoverability

Singularity

Attributes

Uniqueness

Centrality

Homogeneity

Des

ign/

Arc

hite

ctur

e

Corruptibility/controllability

Accessible/detectable/identifiable/transparent/interceptable

Hard to manage orcontrol

Self unawarenessand unpredictability

Predictability

Beh

avio

rG

ener

al

Physical Cyber Human/Social Enabling Infrastructure

Object of Vulnerability

xviii Finding and Fixing Vulnerabilities in Information Systems: VAM Methodology

The methodology uses multiple approaches to identify which security techniquesshould be considered to address the identified vulnerabilities.

First, a matrix maps each vulnerability to security techniques that are either primaryor secondary candidates for mitigating the vulnerability. The matrix also cautionswhen security techniques can incur additional vulnerabilities when they are imple-mented (see Figures S.2 and S.3). Finally, the matrix notes the cases in which vulner-abilities actually facilitate security techniques, thus resulting in a beneficial sideeffect.

Second, users will come to this methodology with different intents, responsibilities,and authorities. The methodology reflects this fact by filtering candidate securitytechniques based on the evaluator’s primary job role—operational, development, orpolicy. The methodology also partitions information system compromises into thefundamental components of an attack or failure: knowledge, access, target vulnera-bility, non-retribution, and assessment. Knowledge of the target system is needed todesign and implement the attack. Access is needed to collect knowledge and executean attack on the target vulnerability. Without the core target vulnerability, no attackis possible in the first place. Non-retribution (or even its first component of non-attribution) is needed to minimize backlash from the operation. Finally, assessmentof an attack’s success is critical when other operations rely on the success of theattack. In the case of a nondeliberate system failure, only the target vulnerability thatenables the failure is the critical component.

RANDMR1601-S.1

Resilience/Robustness

• Heterogeneity• Redundancy• Centralization• Decentralization• VV&A; SW/HW engineering; evaluations;

testing• Control of exposure, access, and output• Trust learning and enforcement systems• Non-repudiation• Hardening• Fault, uncertainty, validity, and quality

tolerance and graceful degradation• Static resource allocation• Dynamic resource allocation• Management• Threat response structures and plans• Rapid reconstitution and recovery• Adaptability and learning• Immunological defense systems• Vaccination

ISR and Self-Awareness

• Intelligence operations• Self-awareness, monitoring, and

assessments• Deception for ISR• Attack detection, recognition,

damage assessment, andforensics (self and foe)

Counterintelligence, Denial of ISRand Target Acquisition

• General counterintelligence• Deception for CI• Denial of ISR and target

acquisition

Deterrence and Punishment• Deterrence• Preventive and retributive

Information/military operations• Criminal and legal penalties and

guarantees• Law enforcement; civil

proceedings

Figure S.1—Security Mitigation Techniques

Summary xix

RANDMR1601-S.2

Vulnerability A

Vulnerability B

Vulnerability C

Vulnerability D

Vulnerability E

Vulnerability F

Vulnerability G

Vulnerability T

•••

Caution

Primary

Secondary Secondary Primary

Technique 1 Technique 2 Technique 3 Technique 4

Figure S.2—The Concept of Mapping Vulnerabilities to Security Mitigation Techniques

RANDMR1601-S.3

Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g; Eva

luat

ions;

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

N

on-Rep

udiatio

n

Harden

ing

Fault,

Unce

rtain

ty, Vali

dity, a

nd Quali

ty

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

overy

Adapta

bility a

nd Lea

rnin

g

Im

munolo

gical D

efen

se S

yste

ms

Vaccin

atio

n

In

tellig

ence

Oper

atio

ns

S

elf-A

waren

ess,

Monitorin

g, and

A

sses

smen

ts

D

ecep

tion fo

r ISR

A

ttack

Det

ectio

n, Rec

ognition, D

amag

e

A

sses

smen

t, an

d Fore

nsics (

Self an

d

Foe) Gener

al Counte

r-Inte

lligen

ce

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Operat

ions

Trust, Authentication, and Access Management

Singularity 2 2 1 -1 2 2 2 1 1 2 2 1 1 1 2 2 2Uniqueness 2 2 1 1 2 2 2 2 1 1 1 -1 2 2Centrality 1 1 0 -2 2 2 2 -1 1 1 2 2 -1 -1 1 -2 2 -1 1 0 1 -1Homogeneity 2 1 -1 1 2 1 2 2 0 0 1 -2 -1 0 0 -1 0 -1

Separability -1 2 -2 2 1 -2 1 -1 1 2 -2 -1 2 -2 1 1 1Logic / Implementation Errors; Fallibility

2 1 1 -1 2 2 1 2 2 1 1 2 1 -1 1 2 2 2

Design Sensitivity / Fragility / Limits / Finiteness

2 -1 2 1 2 -1 2 2 -1 2 -1 2 -1 2 2 2 -1 1 -1 1 1 1 1

Unrecoverability 2 2 1 2 2 1 -1 2 2 1 1 1 1 2 1 1 1

BehavioralSensitivity / Fragility

2 -1 2 -1 1 2 -1 2 2 -1 2 2 2 2 -1 2 1 -1 1 1 -1 1 1

Malevolence 1 1 1 2 2 2 2 2 1 1 1 -1Rigidity 1 -2 1 2 -2 2 -2 2 1 -2 2 2 -1 2 -2 2 2 2 2Malleability 1 1 1 -1 2 1 2 -1 1 2 1 -1 -1 2 2 1 -1 -1Gullibility / Deceivability / Naiveté

-1 2 1 -1 2 -1 1 2 1 -2 -1 2 -1 2 -2 2 -1 1 2

Complacency 1 -1 2 -1 1 -1 2 -1 -1 -1 -1 -1 2 -1 2 -1 2 -1 -1 2 2 -1 1Corruptibility / Controllability

1 1 -1 1 2 2 -1 2 1 2 -1 2 2 -1 1 -1

Accessible / Detectable / Identifiable / Transparent / Interceptable

1 1 -2 2 2 2 2 2 2 1 2 -1 1 1

Hard to Manage or Control

-2 -1 2 -2 2 2 -1 2 -1 2 2 -1 2 2 -1 1

Self Unawareness and Unpredictability

-2 2 -2 2 -1 2 -1 -1 1 1 -1 1 1 -1 -1 2 2

Predictability 2 -1 1 2 -1 1 -1 -1 -2 2 -1 1 -1 1 -1 2 2 -1 1 -1


Resilience / Robustness

Gen

eral

Pro

per

ties

Lea

din

g t

o V

uln

erab

iliti

es

Des

ign

/ A

rch

itec

ture

Beh

avio

r

Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g; Eva

luat

ions;

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

N

on-Rep

udiatio

n

Harden

ing

Fault,

Unce

rtain

ty, Vali

dity, a

nd Quali

ty

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

overy

Adapta

bility a

nd Lea

rnin

g

Im

munolo

gical D

efen

se S

yste

ms

Vaccin

atio

n

In

tellig

ence

Oper

atio

ns

S

elf-A

waren

ess,

Monitorin

g, and

A

sses

smen

ts

D

ecep

tion fo

r ISR

A

ttack

Det

ectio

n, Rec

ognition, D

amag

e

A

sses

smen

t, an

d Fore

nsics (

Self an

d

Foe) Gener

al Counte

r-Inte

lligen

ce

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Operat

ions

1 1 1 1 11 1 1 1 1 11 -1 1 -1 0 -1 -1 1 1 1 2 0

1 1 1 11 -1 2 0 -1 1 -1 1 -1 1

1 1 1 1 1 1

1 2 0 1 1 1 1 1 1

1 2 1 1 1 1 1 1

1 2 1 1 -1 1 -1 1 1 1

2 2 2 2 2 2 2 2 2 2 21 1 1 1 1 -12 1 1 1 1 2 1

2 2 1 1 -1 1 1

2 -1 2 -1 1 1 1 2 -1 1 -1 -1

2 2 1 1 1 2 1

1 1 -1 1 2 2 2 2 2 1 1

2 -1 1 -1 -1 1 1 1

2 -1 2 1 1 -2

0 1 2 2 2 -1

CI, Denial of ISR & Target Acquisition

Deterrence and PunishmentISR and Self-Awareness

Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g; Eva

luat

ions;

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

N

on-Rep

udiatio

n

Harden

ing

Fault,

Unce

rtain

ty, Vali

dity, a

nd Quali

ty

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

overy

Adapta

bility a

nd Lea

rnin

g

Im

munolo

gical D

efen

se S

yste

ms

Vaccin

atio

n

In

tellig

ence

Oper

atio

ns

S

elf-A

waren

ess,

Monitorin

g, and

A

sses

smen

ts

D

ecep

tion fo

r ISR

A

ttack

Det

ectio

n, Rec

ognition, D

amag

e

A

sses

smen

t, an

d Fore

nsics (

Self an

d

Foe) Gener

al Counte

r-Inte

lligen

ce

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Operat

ions




2 1 1 -1 2 2 1 2 2 1 1 2 1 -1 1 2 2 2


2 -1 2 1 2 -1 2 2 -1 2 -1 2 -1 2 2 2 -1 1 -1 1 1 1 1


BehavioralSensitivity/Fragility

2 –1 2 –1 1 2 –1 2 2 –1 2 2 2 2 –1 2 1 –1 1 1 –1 1 1

Malevolence 1 1 1 2 2 2 2 2 1 1 1 –1Rigidity 1 –2 1 2 –2 2 –2 2 1 –2 2 2 –1 2 –2 2 2 2 2Malleability 1 1 1 –1 2 1 2 –1 1 2 1 –1 –1 2 2 1 –1 –1Gullibility/

Deceivability/ Naiveté

–1 2 1 –1 2 –1 1 2 1 –2 –1 2 –1 2 –2 2 –1 1 2

Complacency 1 –1 2 -1 1 –1 2 –1 –1 –1 –1 –1 2 –1 2 –1 2 –1 –1 2 2 –1 1Corruptibility/ Controllability 1 1 –1 1 2 2 –1 2 1 2 –1 2 2 –1 1 –1Accessible/

Detectable/ Identifiable/ Transparent/ Interceptable

1 1 –2 2 2 2 2 2 2 1 2 –1 1 1

Hard to Manage or Control –2 –1 2 –2 2 2 –1 2 –1 2 2 –1 2 2 –1 1


–2 2 –2 2 –1 2 –1 –1 1 1 –1 1 1 –1 –1 2 2

Predictability 2 –1 1 2 –1 1 –1 –1 –2 2 –1 1 –1 1 –1 2 2 –1 1 –1



Gen

eral

Pro

per

ties

Lea

din

g t

o V

uln

erab

iliti

es

Des

ign

/ A

rch

itec

ture

Beh

avio

r

Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g; Eva

luat

ions;

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

N

on-Rep

udiatio

n

Harden

ing

Fault,

Unce

rtain

ty, Vali

dity, a

nd Quali

ty

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

overy

Adapta

bility a

nd Lea

rnin

g

Im

munolo

gical D

efen

se S

yste

ms

Vaccin

atio

n

In

tellig

ence

Oper

atio

ns

S

elf-A

waren

ess,

Monitorin

g, and

A

sses

smen

ts

D

ecep

tion fo

r ISR

A

ttack

Det

ectio

n, Rec

ognition, D

amag

e

A

sses

smen

t, an

d Fore

nsics (

Self an

d

Foe) Gener

al Counte

r-Inte

lligen

ce

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Operat

ions

1 1 1 1 11 1 1 1 1 11 -1 1 -1 0 -1 -1 1 1 1 2 0

1 1 1 11 -1 2 0 -1 1 -1 1 -1 1

1 1 1 1 1 1

1 2 0 1 1 1 1 1 1

1 2 1 1 1 1 1 1

1 2 1 1 –1 1 –1 1 1 1

2 2 2 2 2 2 2 2 2 2 21 1 1 1 1 –1

2 1 1 1 1 2 1

2 2 1 1 –1 1 1

2 –1 2 –1 1 1 1 2 –1 1 –1 –1

2 2 1 1 1 2 1

1 1 –1 1 2 2 2 2 2 1 1

2 –1 1 –1 –1 1 1 1

2 –1 2 1 1 –2

0 1 2 2 2 –1



Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g;

Evalu

atio

ns; T

estin

g


Singularity 2 2 1 -1 2 2Uniqueness 2 2 1 1 2

Centrality 1 1 0 –2 2 2

Homogeneity 2 1 –1 1 2Separability –1 2 –2 2Logic/ Implementation Errors; Fallibility

2 1 1 –1 2

Design Sensitivity/Fragility/Limits/Finiteness

2 –1 2 1 2 –1 2Des

ign

/Arc

hit

ectu

re

Security technique may:2: mitigate vulnerability (primary)1: mitigate vulnerability (secondary)0: be facilitated by vulnerability

–1: incur vulnerability (secondary)–2: incur vulnerability (primary)

Figure S.3—Values Relating Vulnerabilities to Security Techniques

xx Finding and Fixing Vulnerabilities in Information Systems: VAM Methodology

In addition to filtering the techniques further, this partitioning exploits the importantobservation that, in attacks, denial of a critical component of an attack can preventan attack without necessarily addressing the fundamental target vulnerability. Thepartitioning also suggests additional options for evaluators, based on their situationand job role. For example, operational users cannot redesign the architecture of aninformation system developed by others, but they can often limit knowledge andaccess to the system.

AN AUTOMATED AID IN USING THE VAM METHODOLOGY

Finally, an automated prototype tool implemented as an Excel spreadsheet greatlyimproves the usability of the methodology. The tool guides the evaluator throughassessment of vulnerabilities, evaluation of risks, review of cautions and barriers tosecurity techniques, selection of techniques to implement, and estimation of therisks after implementation. Figure S.4 shows the part of the tool where the evaluatorspecifies his or her job role, and the risks are rated across all five attack components.Readers may obtain a copy of this prototype online at www.rand.org/publications/MR/MR1601/.

RANDMR1601-S.4

User (select):

1

1

Attack Thread: Risk (select):

Knowledge

Access

Target

Nonretribution

Assess

Score: Rating Score

(min 1st 3) Moderate Risk 7

(min all) Low Risk 3

min(target,sum all) Moderate Risk 7

min(target, sum 1st 3) Moderate Risk 7

We track all network traffic for last 2 days.

If still inside the network, easy to see loss.

Notes (fill in):

Architectures are commonly known.

Internet systems should have firewalls but remain vulnerable.

Target Vulnerability (fill in):

Attack Thread Evaluation:

All routers are COTS (CISCO).

Moderate Risk

High Risk

Moderate Risk

Low Risk

High Risk

1 2

6 7

5

OperationalDeveloperPolicy

Routers are relatively robust. Patches for Code Red worms are commonly installed.

Figure S.4—User and Attack Component Filtering in the VAM Tool (notional values)

Summary xxi

CONCLUSIONS

The VAM methodology provides a relatively comprehensive, top-down approach toinformation system security with its novel assessment and recommendation-generating matrix and filtering methods.

The vulnerabilities and security taxonomies are fairly complete. Viewing vulnerabil-ity properties separate from system objects has proved to be a valuable way ofreviewing the system for vulnerabilities, since the properties often apply to each typeof object. Also, each object type plays an important role in the information systems.The realization and expansion of the vulnerability review to explicitly consider physi-cal, human/social, and infrastructure objects, in addition to cyber and computerhardware objects, recognize and accommodate the importance of all these aspects ofinformation systems to the proper function of these systems.

VAM fills a gap in existing methodologies by providing explicit guidance on findingsystem vulnerabilities and suggesting relevant mitigations. Filters based on vulner-abilities, evaluator type, and attack component help to improve the usability of therecommendations provided by the methodology.

Providing a computerized aid that executes the methodology during an evaluationgreatly improves the usability of the methodology, especially because the currentapproach generates many more suggestions than the earlier version in Anderson etal. (1999). The current spreadsheet implementation in Excel has the benefit of beingusable by the large number of personal computer users who already have the Excelprogram on their machines. The spreadsheet also gives the user the flexibility to gen-erate analysis reports and even input custom rating algorithms to accommodatelocal needs and situations.

The methodology should be useful for both individuals and teams. Individuals canfocus on their specific situation and areas of responsibility, while teams can bringmultiple kinds of expertise to bear on the analyses, as well as perspectives on differ-ent divisions within an organization. The methodology also can be used in parallel bydifferent divisions to focus on their own vulnerabilities and can be integrated later ata high-level review once each group’s justifications and mappings back to the orga-nization’s functions are understood.

xxiii

ACKNOWLEDGMENTS

Brian Witten of DARPA/ITO proposed examining the utility, completeness, andusability of the earlier published RAND “MEII methodology” for cyber risk assess-ment by applying it to a real-world Department of Defense critical information sys-tem to help validate its usefulness. We appreciate his support and encouragement forthis project.

At RAND, we thank Scott Gerwehr for his insights into the use of deception for infor-mation security. Robert Drueckhammer provided useful discussions on securitypractices of computer support departments. MSgt Les Dishman (USAF, on detail toRAND) provided excellent help in obtaining access to needed documents. Finally, wealso appreciate the very helpful suggestions, questions, and observations fromreviewers Shari Lawrence Pfleeger and Steven Bankes, also of RAND; our report ismuch better as a result of their thoughtful reviews.

In addition, Claire Antón gave valuable insights into ISO standards and their use.

xxv

ACRONYMS

ATO air tasking order

C2 command and control

C4I command, control, communications, computers, and intelligence

CARVER Criticality, Accessibility, Recuperability, Vulnerability, Effect,and Recognizability

CC Common Criteria for Information Technology Security Evaluation

CERT Computer Emergency Response Team

CI counterintelligence

COTS commercial off-the-shelf

DARPA Defense Advanced Research Projects Agency

DDoS distributed denial-of-service

DoD Department of Defense

EMP electromagnetic pulse

GCCS-M Global Command and Control System–Maritime

I&W Indications and Warning

I/O input/output

INFOCON Information Conditions

IO information operations

IP Internet Protocol

ISO International Standards Organization

ISR intelligence, surveillance, and reconnaissance

IT information technology

xxvi Finding and Fixing Vulnerabilities in Information Systems: VAM Methodology

IVA Integrated Vulnerability Assessment

IW information warfare

JFACC joint force air component commander

LAN local area network

MEII minimum essential information infrastructure

MOU memorandum of understanding

Nmap Network Mapper

OCTAVESM Operationally Critical Threat, Asset, and Vulnerability EvaluationSM

OPSEC Operations Security

ORM Operational Risk Management

PKI public key infrastructure

PP protection profile

PsyOps psychological operations

ROM read-only memory

SIPRNet Secure Internet Protocol Router Network

SW/HW software/hardware

TCSEC Trusted Computer System Evaluation Criteria

USAF United States Air Force

VAM Vulnerability Assessment and Mitigation

VV&A validation, verification, and accreditation

1

Chapter One

INTRODUCTION

Many organizations’ critical functions rely on a core set of information system capa-bilities. Securing these capabilities against current and future threats requires abroad and unbiased view of system vulnerabilities, as well as creative considerationof security and stability options in the face of resource constraints. Interoperability,information sharing, collaboration, design imperfections, limitations, and the likelead to vulnerabilities that can endanger information system security and operation.Unfortunately, understanding an organization’s reliance on information systems, thevulnerabilities of these systems, and how to mitigate the vulnerabilities has been adaunting challenge—especially for less well-known or even unknown vulnerabilitiesthat do not have a history of being exploited.

RAND has developed and evolved a methodology to help analysts understand theserelationships, facilitate the identification or discovery of system vulnerabilities, andsuggest relevant mitigation techniques. This Vulnerability Assessment and Mitiga-tion (VAM) methodology builds on earlier work by Anderson et al. (1999); it fills amuch-needed gap in existing approaches by guiding a comprehensive review of vul-nerabilities across all aspects of information systems and mapping the vulnerabilitiesto specific security techniques that can address them.

The VAM methodology takes a top-down approach and seeks to uncover not onlyvulnerabilities that are known and exploited or revealed today but also the vulner-abilities that exist yet have not been exploited or encountered during operation.Thus, the methodology helps to protect against future threats or system failureswhile mitigating current and past threats and weaknesses. Sophisticated adversariesare always searching for new ways to attack unprotected resources (the “soft under-belly” of the information systems); thus, the methodology can be valuable as a way tohedge and balance current and future threats. Also, the complexity of informationsystems, and their increasing integration with organizational functions, requiresadditional considerations to ensure that design or architectural weaknesses are miti-gated.

WHO SHOULD USE THE VAM METHODOLOGY?

This report should be of interest to individuals or teams conducting vulnerabilityassessments and planning mitigation responses. Because it facilitates the identifica-tion of new vulnerabilities, it should be of particular interest to designers building

2 Finding and Fixing Vulnerabilities in Information Systems: VAM Methodology

new systems, as well as to security specialists concerned about highly capable andwell-resourced system attackers, such as nation-states or terrorists motivated toidentify new security holes and exploit them in subtle and creative ways. The VAMmethodology also facilitates a comprehensive review of known vulnerabilities in bal-ance with new vulnerabilities so the user can determine the most serious problemsand address them in a rational approach.

The methodology provides a broad view of vulnerability sources (either commonlyknown or unrecognized until now), system objects, and security alternatives to helpavoid prior biases, so both outside assessors and people within an organizationshould find it useful. However, the methodology requires both objectivity andknowledge of the system in question; therefore outsiders will need access to systemexperts, while insiders will need to approach an assessment with an open mind.

We also found, in using the methodology to examine operational systems, that peo-ple in different roles in an organization have different security options available tothem. Thus, designers, operators, and policymakers can all benefit in their comple-mentary use of the methodology.

Furthermore, we found the methodology useful in examining information warfareconcepts, in which vulnerabilities and security responses of information systems areimportant considerations. Thus, the methodology may also be of interest to personsinvolved in other aspects of information operations (IO), including exploitation andattack.

PREVIOUS RESEARCH

In 1999, Anderson et al. at RAND published Securing the U.S. Defense InformationInfrastructure: A Proposed Approach (also known as the “MEII Study”). The originalgoal of the study was to explore the concept of a “minimum essential informationinfrastructure” (MEII) for the Department of Defense (DoD). The report outlined asix-step process for risk reduction in critical DoD information systems. Its main con-tribution was a listing of 20 generic areas of potential vulnerability in complex infor-mation systems used for command, control (C2) and intelligence. It also listed 13general areas of security techniques that could be used in various ways to mitigatethese vulnerabilities and provided a color-coded matrix showing which securitytechniques tended to work best against which vulnerabilities. The earlier study’sresults were theoretical and had not yet been applied to a real system.

In November 2000, Brian Witten of the Defense Advanced Research Projects Agency(DARPA) suggested that the original study’s framework should be used to study anoperational DoD C2 system to assess the methodology’s effectiveness in uncoveringunexpected sources of vulnerability and to suggest relevant security techniques fortheir mitigation. That follow-on study began in spring 2001. This report is one of twodocuments resulting from that work.

During the course of the study, we determined that the earlier methodology (list ofvulnerabilities mapped to a list of security techniques) was valuable; however, thelists needed updating and better ways were needed to handle the large amounts of

Introduction 3

security suggestions generated. This present report outlines the updated andextended methodology. The VAM methodology now identifies a more comprehen-sive and taxonomical set of attributes that leads to vulnerabilities and the securitytechniques that can mitigate them; an expanded map between attributes andsecurity techniques; filters that refine the list of security techniques to consider; anda software tool that automates table and filter lookups, along with additionalinformational guidance.

Unpublished RAND research by the authors of this report explored the issues andresults from applying the VAM methodology to military tactical information systems.Because this study contains details of sensitive information, the results mentionedabove may be available only to authorized government individuals by contactingPhilip Antón ([email protected]) or Robert Anderson ([email protected]). However,the nonsensitive lessons learned from that application study are incorporated in themethodology described below.

STRUCTURE OF THIS REPORT

The rest of this report is organized as follows:

Chapter Two defines what constitutes an information system. It then provides a con-ceptual discussion of what leads to vulnerabilities and introduces concepts that helpto understand vulnerabilities, where they arise, and how they can be mitigated.

Chapter Three provides an overview of the six steps of the VAM methodology alongwith a notional example. The chapter also describes how the methodology compareswith and relates to other security methodologies. Since the core of the VAMmethodology involves the identification of vulnerabilities and the selection of secu-rity techniques to mitigate them, Chapters Four through Seven provide details ofhow VAM helps the user accomplish this.

Chapter Four provides an in-depth description of the attributes of system objectsthat can lead to vulnerabilities (step 3 of the methodology) and examples of how theycombine in some well-known information system vulnerabilities.

Chapter Five gives an in-depth description of information system security tech-niques and examples of how they combine in some well-known security approaches.

Chapter Six describes how the VAM methodology maps the vulnerabilities in ChapterFour to the security techniques in Chapter Five to provide specific guidance on howto address identified vulnerabilities. Next, the chapter illustrates filtering techniquesto improve the appropriateness of the security techniques identified in the matrix tothe particular user type and attack stage. Chapters Five and Six describe step 4 of themethodology and support the selection of security techniques (step 5). Finally, thechapter provides specific examples of the kinds of specific security countermeasuresthat can be identified for specific, common information system vulnerabilities by anoperational evaluator employing the methodology.


Chapter Seven describes a spreadsheet implementation of the VAM methodologythat automates looking up information and explanations in the methodology.

Chapter Eight discusses some deficiencies in the current VAM methodology, possiblenext steps, and some general discussion.

Chapter Nine presents final conclusions and perspectives.

The Appendix contains detailed information behind the ratings in the matrix thatmaps vulnerabilities to candidate security techniques.

5

Chapter Two

CONCEPTS AND DEFINITIONS

Before describing the content and processes in the VAM methodology, we need toexplore the underlying concepts and terminology it employs: What, for example,constitutes an information system? What leaves such a system vulnerable to attack orfailure? What types of components can have vulnerabilities?

SECURITY

“Security” means different things to different people, depending on their view ofwhat can lead to a compromise of the system in question. We take a broad view ofsecurity to include any issue that affects the safe and reliable performance of thesystem. Compromises to the system can therefore arise not only from overt attacksby adversaries but also from accidents, faults, failures, limitations, and naturalcauses.

INFORMATION SYSTEMS

We use the term “information system” quite broadly to include any system or com-ponent (whether physical, cyber, virtual, computer, communication, human, orsocial) that is involved in storing, processing, handling, or transmitting information.While the scope of an information processing system can be defined more narrowly(i.e., purely by computer software and hardware), we are often concerned with theinformation-related functions of and for organizations. Anything that can lead tofailure in, or compromise of, an information system component can endanger theperformance of the organization and its mission, thus imploring consideration whensecuring the system.

SYSTEM OBJECT TYPES

We explicitly represent the different types of system components according towhether they are physical, cyber, human/social, or enabling infrastructure.

Physical. These objects include, for example, hardware (e.g., data storage,input/output [I/O], clients, and servers), networks and communications betweenand within nodes, and physical locations at various levels within the system’s archi-tecture.


Cyber. Cyber objects include, for example, software, data, information, and knowl-edge. Often they exist “virtually” in electronic or even conceptual representationsthat are far removed from the physical forms or media (e.g., disks, paper, binaryswitches) in which they exist.

Human/Social. Human and social objects include, for example, users and other staff,developers, management, command structures, policies, procedures, training, andauthentication.

Enabling Infrastructure. Infrastructures include, for example, physical housings(e.g., buildings, vehicles), power, water, air, and other environmental conditionings.

The scope of this object list allows a more comprehensive examination of all theobjects in a system, not merely the computer hardware and software (which are sooften focused on). For example, information is processed and handled by humanswithin an organization, not just by computers and networks. In fact, human process-ing of information is a key component in information systems, and the vulnerabilityof human and social systems must be addressed during a comprehensive evaluationof risks.

On the Use of the “Object” Concept

The use of an “object” is a common theoretical tool in information science thatallows one to address a person, place, or thing while elucidating its properties orbehaviors of interest. The partitioning of information system components into con-ceptual “objects” allows us to emphasize components that are often neglected whenconsidering security. Cyber objects are automated, computerized, software, or virtualcomponents that are normally considered as the components of information sys-tems. However, these objects usually occupy and rely on physical objects as well (e.g.,the physical devices that instantiate virtual objects, the buildings in which thedevices reside, or the physical spectra that they exploit). Human beings are other“objects” that process information in the system; they use, manage, and control thesystem, its objects, and its goals. Humans exist in multiple social structures thatinfluence their behavior. Finally, all three of these types of objects rely on infrastruc-ture components that are not formally part of the information system yet supply vitalsupport to the system (e.g., power, air, food, temperature control).

ATTRIBUTES AS SOURCES OF VULNERABILITIES

Vulnerabilities arise from identifiable attributes of information system objects. TheVAM methodology explores this genesis explicitly, providing a relatively comprehen-sive, high-level review of vulnerabilities from first principles and mapping themacross all object types. This approach guides the evaluator to examine all vulnera-bilities—not just the ones that are known or have been exploited to date—andexplores the vulnerabilities across all the system’s objects—not just the cyber-relatedcomponents.

Concepts and Definitions 7

Anderson et al. (1999) first explored the concept of information system vulnerabili-ties arising from attributes of the information system. Our work builds on these con-cepts by explicitly separating the objects from the attributes they exhibit and expand-ing the list of attributes that lead to vulnerabilities.

Separating vulnerability attributes from system object types encourages the exami-nation of potential vulnerabilities from applying attributes normally associated withcertain object types to other types of objects in the system. For example, singularitiescan be present not only in cyber software or physical hardware but also in unique,irreplaceable people (users) who alone know how to operate certain equipment orprocess certain types of information.

Security Techniques

Finally, we handle the vast number of security techniques in use or under researchby the information security community by categorizing them according to theapproach they take to mitigate vulnerabilities. Thus, we can methodologically treatthese techniques in the abstract and describe how they relate to the vulnerabilitiesthey mitigate. Techniques in each category are listed in Chapter Five. The categoriesare not of equal size; historically, more attention has been paid to some techniquesthan to others. In some cases, this skew is quite logical; in other cases, there are newtechniques that provide important promise and deserve added attention in thefuture. Considering the techniques by approach type helps in looking for the besttechnique that logically meets a vulnerability challenge, without getting unduly dis-tracted by their differences.

9

Chapter Three

VAM METHODOLOGY AND OTHER DoD PRACTICES INRISK ASSESSMENT

OVERVIEW OF THE VAM METHODOLOGY

In the late 1990s, RAND published a six-step methodology to improve the securityposture of critical information systems (Anderson et al., 1999). The steps were to

1. Identify your organization’s essential information functions.

2. Identify information systems essential to implementing the essential functions instep 1.

3. Identify vulnerabilities of the essential systems in step 2.

4. Identify pertinent security techniques to mitigate the vulnerabilities in step 3using the VAM matching matrix tool.

5. Select and apply techniques from step 4 based on constraints, costs, and benefits.

6. Test the techniques applied in step 5 for robustness and actual feasibilities underthreat.

Repeat steps 3–6 as needed.

Note in particular that the methodology includes an explicit mapping of vulnerabili-ties to security techniques (step 4). This mapping forms the core of the methodologyand provides the evaluator with explicit guidance on addressing the vulnerabilities.The current work in this report expands the size and complexity of this matrix toimprove the comprehensiveness of the matrix approach.

We give an overview below of how this six-step process works, along with a concep-tual military example of its use. Even though we illustrate the basic steps using a mili-tary example, the VAM methodology can be applied to other critical commercial andgovernment functions as well.

The most involved parts of the VAM methodology are found in steps 3 and 4 (theidentification of vulnerabilities and the generation of security techniques to mitigatethem). Chapters Four through Seven provide additional details on the steps beyondwhat is included here.


Step 1. Identify Essential Information Functions

Information systems are not ends in themselves. They are employed by individualsand organizations to support specific functions and operations. Given limitedresources, security vulnerabilities that endanger the essential information-basedfunctions should be addressed first. Thus, an individual trying to identify and miti-gate these vulnerabilities first needs to distinguish what the essential functions are.

Process. An objective process can guide the identification of an organization’sessential information functions.

First, a strategies-to-tasks analysis (Lewis and Roll, 1993; Thaler, 1993; Kent andSimons, 1994) can be conducted. Here the goals and strategies of the organizationare identified and prioritized, and the strategies are mapped to the tasks (functions)designed to implement the strategies.

Second, specific information functions in support of these tasks are identified andcategorized.

Third, measures of essentiality are developed and employed to rank the informationfunctions into the following categories: essential, valuable, and expendable. Essentialfunctions are those that, if compromised, prevent the organization from performingits important tasks satisfactorily (as defined by the strategy-to-tasks requirements).Valuable functions are those in which work-arounds can be identified; yet the work-arounds have significant performance costs and risks. Expendable functions arethose in which work-arounds with acceptable performance costs and risks can beidentified.

Finally, all the identified functions are integrated to develop an overall ranking ofinformation functions. Special attention should be paid to looking for functionsessential or valuable to many or all tasks. Also, sets or logical groupings of functionsthat support numerous tasks should be identified where possible, thus identifyingregions of functionality that require particular attention.

Example. In an example of notionally applying the methodology to a military organi-zation, a joint force air component commander (JFACC)1 performs a number of func-tions in the execution of an air campaign, including generating and distributing anair tasking order (ATO),2 analyzing logistics support needs, planning fuel resourceallocations, planning medical operations, and teleconferencing with other military

______________ 1DoD defines a JFACC as

The commander within a unified command, subordinate unified command, or joint task force responsible to theestablishing commander for making recommendations on the proper employment of assigned, attached, and/ormade available for tasking air forces; planning and coordinating air operations; or accomplishing suchoperational missions as may be assigned. The joint force air component commander is given the authoritynecessary to accomplish missions and tasks assigned by the establishing commander. . . . (Joint Chiefs of Staff[2003])

See also Joint Chiefs of Staff (1994) for details on the roles of the JFACC in military air planning.2During military operations, an ATO specifies which aircraft are assigned which tasks (e.g., conductingpatrols, dropping munitions on specific targets, providing troop and supply transport).

VAM Methodology and Other DoD Practices in Risk Assessment 11

planners (see Figure 3.1). Of all the functions listed, the generation and distributionof the ATO (in the solid oval) could arguably be selected as the critical function thatmust be supported in the near term. The other functions are less time-critical andserve secondary support to the generation (and ultimately execution) of the ATO.Thus, we select the generation and distribution of the ATO as the “essential informa-tion function” for the JFACC organization.

Step 2. Identify Essential Information Systems

Given the essential information-related functions from step 1, the essential informa-tion systems that support or implement these functions now need to be identified.

Process. First, the information systems used to perform the essential functionsidentified in step 1 need to be identified and categorized. These systems form the listof candidate “essential” information systems.

Again, measures of essentiality are developed and employed to rank the informationsystems as essential, valuable, or expendable. Finally, all the identified systems areintegrated across the functions to develop an overall ranking of information systems.Special attention should be paid to looking for systems critical to many or allfunctions. Also, sets or logical groupings of systems that support numerous functionsshould be identified where possible, thus identifying logical sets of systems thatrequire particular attention.

Example. In our continuing example, if located on a ship, a JFACC and his or her staffemploy a number of information systems to support their operations. These infor-mation systems include the Global Command and Control System–Maritime (GCCS-M), the Global Combat Support System (GCSS) for logistics, the so-called CommonOperating Environment (COE) supplied on many general-purpose military comput-ers, the Secure Internet Protocol Router Network (SIPRNet), and the public switched

RANDMR1601-3.1

TeleconferencingFu

nct

ion

s Fuel resourceplanning

Logistics supportanalysis

Medicalplanning

Distribute airtasking order

Figure 3.1—Example Functional Decomposition of JFACC Information Functions


telephone network (see Figure 3.2). Because step 1 identified the generation and dis-semination of an ATO as the essential function, we need to select the essential infor-mation systems that support that function. GCCS-M and SIPRNet (in solid, boldboxes) are the essential information systems that support the ATO. Of these two sys-tems, and from the perspective of passing information to the JFACC for processing,SIPRNet could be identified as the main information communication backbone thatis most essential to support the ATO generation and dissemination function; yetGCCS-M is also essential for rapid ATO generation.

Step 3. Identify System Vulnerabilities

Given the prioritized list of essential information systems from step 2, we can nowfocus on examining the systems for vulnerabilities. This is the step in which the VAMmethodology uniquely begins to contribute advice, since many other methodologieslack specific help in determining vulnerabilities. Note that a successful vulnerabilityassessment requires the insights and experience of system users and developers asoutlined below; so both methodological guidance and experience are important.

Here we describe the process involved in step 3, along with a notional example.Chapter Four details how this assessment is conducted from an objective, top-down

RANDMR1601-3.2

Distribute airtasking order

Fuel resourceplanning

Logistics supportanalysis

Medicalplanning Teleconferencing

Global CombatSupport System

Common OperatingEnvironment

Public SwitchedTelephone Network

SIPRNet

Global Command andControl System–M

Sys

tem

sF

un

ctio

ns

Figure 3.2—Example Information Systems Supporting the JFACC Information Functions


perspective of inherent attributes that lead to vulnerabilities, including additionaldetails on the vulnerability form, specific vulnerability attributes, and the distinctionof attributes from system object types. Specific examples of common vulnerabilitiesare included in Chapter Four and at the end of Chapter Six.

Process. The VAM methodology takes a broad approach to vulnerability analysis byasking the evaluator to complete a matrix containing a relatively comprehensive tax-onomy of attributes that lead to vulnerabilities across all types of system objects (seethe schematic in Table 3.1).

Vulnerabilities should be reviewed at various levels within a system. For example, acyber object’s vulnerabilities should be reviewed at the global architecture level (e.g.,major systems, their interactions, and the systems that provide global communica-tion of data); application components in the architecture (i.e., specific applicationsranging from commercial software components to custom applications designed tomeet the unique processing needs of the organization’s users); common supportingsoftware (e.g., database software, encryption/decryption packages, support li-braries); communication-level components (e.g., software that interfaces directlywith communication lines), and so on. The goal is to review the components that arekey to the system’s proper and reliable operation no matter what the level, yet

Table 3.1

Vulnerability Matrix: Attributes of Information System Objects

RANDMR1601table-3.1

System Objects

Cyber Human/Social InfrastructurePhysical

Vu

lner

abili

ty A

ttri

bute

s Des

ign/

A

rchi

tect

ural

Beh

avio

ral

Gen

eral


judgments of the criticality are important lest the user get buried in noncriticaldetails.

Along with the vulnerability taxonomy, the evaluator should review past experiencewith the critical systems, asking the following questions:

• What has failed in the past? Why?

• What has been the effect of these failures?

• What corrective actions have been tried?

Efforts should be made to explain these experiences with theoretical models.3 If theexperiences are consistent with the models, then the evaluator should gather statis-tics on the failures to help identify which have been more serious in the past. If themodels are insufficient, then the evaluator should attempt to refine or extend themodels or find other models that may help to reveal the underlying reasons why fail-ures have been occurring. These models need not be detailed, but they should helpto identify which vulnerability attributes have been leading to failure and which arepresent in the system.

The evaluator can also look for vulnerabilities by examining the security techniquesalready employed in the system and considering the vulnerability cautions identifiedin the matrix in step 4 below associated with these security techniques.

Finally, the evaluator needs to assess what theoretical vulnerabilities are in the sys-tem for which there is no real-world or test experience. The evaluator should reviewthe system’s components, with the full list of vulnerability attributes, as a checklist.The presence of such attributes represents a potential vulnerability that needs to beinvestigated further to determine how serious the vulnerability may be. Again, theo-retical models of system function may be useful to explore and explain the role theseattributes may play in potential compromises or failures. Statistics may or may notbe available, but the space of plausible threats or failures should be examined toassess the significance of the potential vulnerability against important capabilities ofthe information system.

Example. Considering GCCS-M and SIPRNet, identified in step 2, we ask what thecritical vulnerabilities are that we need to address to support these information sys-tems (see Figure 3.3). Identification of specific vulnerabilities for these military sys-tems is beyond the scope of this report, so we treat vulnerabilities in the abstract.Notionally, we work through the potential types of vulnerabilities and identify thatGCCS-M contains vulnerabilities E and F. If security technique 3 is already employedin GCCS-M, the user then should also see if vulnerability T is present (see Figure 3.4).Remember that we need to search for these vulnerabilities at the various levels of

______________ 3For example, some intrusion detection systems use models of “normal” communication behavior to lookfor such outliers as heavy communication from a particular piece of software or machine that has histori-cally had very low communication. Other models may be as simple as anticipated component failure ratecurves against which data can be collected to locate abnormal failure rates. Still other models may besecurity profile models of staff that can be used in background checks to help identify possible staff com-promises or behavior patterns that may lead to weaknesses and problem behavior.


GCCS-M; so, we should examine GCCS-M as a whole, its primary applications, andthe critical supporting components (e.g., SIPRNet). Within SIPRNet, various levelsneed examination, including the government and commercial software used, thecommunication systems, the networking system and routers, the administrativeoperators, and the physical components, such as cabling and critical supportinginfrastructure.

Step 4. Identify Pertinent Security Techniques from Candidates Given bythe VAM Methodology

Identifying vulnerabilities can be a difficult task, but determining how to addressthem can be even more difficult and frustrating. The VAM methodology provides atheoretical mapping not only to help prioritize the mitigation techniques that natu-rally come to mind but also to provide a relatively comprehensive review of othertechniques that may not be obvious initially.

Process. The VAM methodology contains a large matrix that identifies general secu-rity techniques relevant to each vulnerability. The matrix also identifies cautionswhere the security technique might incur an additional vulnerability. A schematic ofthe matrix is included in the example below, illustrating how the matrix is used toidentify potential security techniques that address the vulnerabilities of concern.

RANDMR1601-3.3

Potentialvulnerabilities:

Vulnerability A

Vulnerability B

Vulnerability C

Vulnerability D

Vulnerability E

Vulnerability F


Figure 3.3—Identifying Which Vulnerabilities Apply to the Critical System


Chapters Six and Seven describe this matrix in detail, along with usability issues anda spreadsheet implementation that automates the security technique candidatelookups.

Example. In step 3, vulnerabilities E and F were identified as the critical notionalvulnerabilities for GCCS-M. Figure 3.4 gives a notional diagram of the VAM table thatmaps these vulnerabilities to appropriate mitigation techniques. In our example,techniques 2 and 4 are the primary techniques that may address vulnerabilities E andF (respectively). Techniques 2 and 3 are alternates, secondary techniques that mayaddress vulnerability F. Thus, we examine techniques 2 and 4 first to see if they fit theneeds of GCCS-M. If they do not, we then consider technique 3.

The map also identifies vulnerability side effects that may be incurred from theemployment of a mitigation technique. Here, technique 3 may introduce vulnerabil-ity T in some cases, so a caution is noted to watch for the incursion of vulnerability Tif technique 3 is implemented.

Since this example is quite notional, the reader may wish to see the end of ChapterSix for concrete examples of security techniques developed for some commoninformation system vulnerabilities.

Step 5. Select and Apply Security Techniques

Process. The list of appropriate security techniques identified in step 4 must now beculled down to a set that can be implemented given the available resources andresponsibilities of the evaluator’s organization. While the evaluator can apply sometechniques directly, other techniques may be out of the purview of the evaluator and

RANDMR1601-3.4

Vulnerability A

Vulnerability B

Vulnerability C

Vulnerability D

Vulnerability E

Vulnerability F

Vulnerability G

Vulnerability T

•••

Caution

Primary

Secondary Secondary Primary


Figure 3.4—The Concept of Mapping Vulnerabilities to Security Mitigation Techniques


his or her organization. In the latter case, promising approaches in this category canbe passed along to responsible parties. Also, the large number of options generatedby the matrix can suggest other areas that may not have been the most obvious ordirect, yet that may reduce the vulnerability of the system. For example, manage-ment, counterintelligence (CI), and retribution measures can help protect the systemand deter attacks when software changes and protection programs are not options touser communities.

Example. In the example case of GCCS-M, we then apply techniques 2, 3, and 4 tobolster GCCS-M (see Figure 3.5).

Step 6. Test for Robustness Under Threat

Simply adding more security techniques does not necessarily imply that the prob-lems have been resolved. The improved system should be tested under actual orsimulated threat conditions to determine how effective the mitigation has been. Vul-nerability information from such testing can be applied back into step 3 to helpdetermine other security options to consider and apply.

Process. Test the effectiveness of the improved system. Red teaming is an importantapproach for such testing because it provides an independent examination of vul-nerabilities and robustness. These teams should not only test against known prob-lems and fixes but also look for and identify new problems (including any introducedinadvertently with the newly added security techniques). Residual concerns shouldbe addressed in realistic exercises (or sometimes in operational settings if appropri-ate) to test procedures and work-arounds.

Other test approaches may also be useful. The security implementers (or indepen-dent parties or companies) that specialize in security assessments could also conduct

RANDMR1601-3.5



Figure 3.5—Identifying Security Techniques to Consider


an inspection and validation of the implementation. If failure or compromisestatistics were utilized in step 3, these values could be compared with post-implementation statistics over a sufficiently long or utilized period to quantify thesuccess of the mitigations. In some cyber parts of the system, automated attack orusage tools could be implemented to explore how well the system responds undersimulated attacks. Note, however, that many automated tools are limited to com-mon, well-known, and previously exploited vulnerabilities. Thus, they do not ingeneral address the full breadth of system components, especially when physical,human/social, and infrastructure components are not stressed.

The best test procedures will incorporate a model of the threat to assess the probabil-ity of the threat successfully compromising the system. These models should bebroad enough to incorporate both the threat’s ability to discover a previously unex-ploited vulnerability and the threat’s technical ability to exploit the vulnerability.

The tests may focus on the part of the system that has been modified, but secondaryand tertiary effects on the rest of the system and other functions need consideration.

Finally, the results of the tests, along with the previous five steps, should be docu-mented and assessed to determine if additional work is needed starting with step 3.

Example. In our example, a (simulated) threat is applied to GCCS-M to ascertain itsrobustness (see Figure 3.6).

OTHER DoD VULNERABILITY ASSESSMENT METHODOLOGIES

Many methodologies and assessment techniques are used by the commercial sectorand by DoD to identify vulnerabilities and design security activities. We describebriefly some of the more common ones below and discuss how the VAM methodol-ogy relates to them.

RANDMR1601-3.6



(Simulated) Threat

Figure 3.6—Test the Revised System Against (Simulated) Threats


OCTAVE

The Operationally Critical Threat, Asset, and Vulnerability EvaluationSM (OCTAVESM)is a framework created by the Software Engineering Institute at Carnegie MellonUniversity for identifying and managing information security risks (Alberts et al.,1999, 2001).4 It defines a set of processes for identifying important organizationalmissions, threats to organizations, and vulnerabilities that the threats may exploit.OCTAVE also includes processes for developing protection strategies to reduce therisks from these vulnerabilities and threats. The framework is laid out in the follow-ing set of “Processes” (see Alberts et al., 1999):

1. Identify enterprise knowledge.

2. Identify operational area knowledge.

3. Identify staff knowledge.

4. Establish security requirements.

5. Map high-priority information assets to information infrastructure.

6. Perform infrastructure vulnerability evaluation.

7. Conduct multidimensional risk analysis.

8. Develop protection strategy.

OCTAVE is heavily process oriented, helping an evaluator structure a project to ana-lyze and mitigate information security risks. These process guidelines can play avaluable role in organizing the activity, but processes 6 and 8 do not have a systemfor reviewing the fundamentals that lead to vulnerabilities. Also, these processes donot produce recommended protection strategies relevant to the identified vulnera-bilities. Thus, the VAM methodology complements the OCTAVE framework. An eval-uator may benefit from the combined use of both approaches.

ISO/IEC 15408: Common Criteria

International Standard 15408, the Common Criteria for Information TechnologySecurity Evaluation (or “CC” for short), is a guideline that indicates which systemaspects should be addressed in which categories of processes when evaluating thesecurity of information technology (IT) products and systems.5,6 The CC is meant tobe relevant for “consumers,” “developers,” and “evaluators” of information systemsand components. The CC states that any security analysis should examine the physi-

______________ 4Also see the OCTAVE website at www.cert.org/octave/.5See www.commoncriteria.org for details on the standard and its history.6CC evolved from the Trusted Computer System Evaluation Criteria (TCSEC) developed in the UnitedStates in the 1980s. In the early 1990s, Europe developed the Information Technology Security EvaluationCriteria (ITSEC) built on the concepts of the TCSEC. In 1990, the International Standards Organization(ISO; www.iso.ch) sought to develop a set of international standard evaluation criteria for general use. TheCC project was started in 1993 to bring all these (and other) efforts together into a single internationalstandard for IT security evaluation. ISO formally accepted CC as International Standard 15408 in 1999.


cal environment a system will exist in, the assets requiring protection, and the pur-pose of the system to be evaluated (“target system”). It then mandates a listing of theassumptions, threats, and organizational security policies, leading to a set of securityobjectives to be met. Using these objectives, a set of security requirements should begenerated, including functional and assurance requirements as well as requirementsfor the environment within which the target system will operate. Requirements thatrecur in various systems and settings become the “protection profile” (PP), which isintended to be reusable and defines the target system’s security requirements“known to be useful and effective in meeting the identified objectives, both for func-tions and assurance. The PP also contains the rationale for security objectives andsecurity requirements.”7 Evaluations—including various types of penetration test-ing—should then be carried out to determine a level of compliance with the PP.

The CC guidelines are complex, embodying many hundreds of pages of documenta-tion. Much of the vulnerability analysis within the process is based on the developer’svulnerability analysis, which is then examined by an evaluator to determine com-pleteness and whether “appropriate measures are in place to prevent the exploita-tion of obvious vulnerabilities in the intended environment.”8 Other tables andcharts allow an evaluator to calculate the “attack potential” of a target system basedon the elapsed time it would take to perform a successful attack, the expertiserequired, the knowledge of the target system available, the access required, and theequipment needed.

We cannot do justice here to the CC framework, nor is it our intent to critique it. Wedo not find within the published materials, however, much guidance for developersand others regarding where within the complex architecture of an information sys-tem one should look for potential vulnerabilities, how to look for them in a method-ological way, and which security techniques are most applicable in mitigating anyflaws found. We believe the concepts and listings in the VAM methodology could be auseful augmentation to the CC process in all these areas.

ISO/IEC 17799: Code of Practice for Information Security Management

International Standard 177999 arose from the British Standard 7799 on informationsecurity management. It is increasingly used as a substantial checklist for ensuringthat information security practices are in place within an organization. It coversmany relevant aspects for information security management, including the follow-ing:

• security policy (in a documented form)

• organization security (within the organization, the security of third-party access,and security of outsourcing procedures)

______________ 7See Common Criteria (1999a, p. 28).8See Common Criteria (1999e, p. 365).9First edition dated December 12, 2000.


• asset classification and control

• personnel security, including appropriate job definitions, user training, andresponse procedures

• physical and environmental security

• communications and operations management

• access controls, including monitoring system access and use and security ofmobile computing (e.g., wireless) access

• systems development and maintenance

• compliance procedures.

The thoroughness of this set of categories is admirable, but each is treated quitesuperficially within the standard itself. The checklist within the standard is areminder of “best practices” resulting from experience with secure/insecure infor-mation systems, but the standard does not give much guidance in understanding thelevels of threats faced and where vulnerabilities may lurk, which are the underlyingmotivations for this guidance. We have used the list of security management tech-niques in this standard as one of the sources consulted in developing our list ofsecurity mitigation techniques (see Chapter Five).

Operations Security

Operations Security (OPSEC) as a methodology originated during the Vietnam War asa way of finding out how the enemy was obtaining advanced information on certaincombat operations in Southeast Asia.10 OPSEC is a countermeasures program forprotecting critical information (see also Army Regulation 530-1, Operations Secu-rity;11 Joint Doctrine for Operations Security;12 Williams, 1999; and Hamby, 2002).OPSEC involves the following five steps:

1. Identify the critical information to be protected.

2. Analyze the threats.

3. Analyze vulnerabilities.

4. Assess risks.

5. Apply countermeasures.

The five OPSEC steps parallel VAM in general, with the added explicit representationof threat and risk assessments. Nevertheless, OPSEC doctrine typically contains littleguidance on how to identify vulnerabilities or select countermeasures to addressthem. Here the techniques in the VAM methodology could be useful.

______________ 10See U.S. Army Communications Electronics Command (1999).11U.S. Department of the Army (1995).12Joint Chiefs of Staff (1997).


Operational Risk Management

Operational Risk Management (ORM) is another military process for managing risksacross all hazards facing the military (i.e., including but not limited to informationsystem hazards).13 ORM is a decisionmaking process designed to review and antici-pate basic aspects of hazards and reduce risks to acceptable levels. ORM grew out ofideas originally developed to improve safety in the development of weapons, aircraftand space vehicles, and nuclear power. The U.S. Army adapted ORM in 1991 toreduce training and combat losses. ORM involves the following five steps:

1. Identify hazards.

2. Assess hazards.

3. Make risk decisions.

4. Implement controls.

5. Supervise.

The basic concept in ORM is to conduct a risk-reduction review and provide thesefive general steps as items that should be considered, rather than providing adetailed methodology for all types of hazards. ORM recommends the use of tech-niques, such as brainstorming, to generate ideas and affinity diagrams to break downan operation into categories (e.g., enemy, troops, terrain, time) in order to focus theanalysis on one area at a time.14

As with OPSEC, the five ORM steps parallel VAM in general, with the added explicitrepresentation of making risk decisions. ORM doctrine also contains little guidanceon how to identify hazards (vulnerabilities) or select controls (countermeasures) toaddress them. Here also the techniques in the VAM methodology could be useful.

Integrated Vulnerability Assessments

Navy Integrated Vulnerability Assessments (IVAs) involve checklist reviews of sys-tems in order to list the top vulnerabilities a command is concerned with and is fol-lowed by brainstorming security mitigations that can be implemented in response.An additional methodology, CARVER (Criticality, Accessibility, Recuperability, Vul-nerability, Effect, and Recognizability), is mentioned as a means for prioritizing vul-nerabilities. CARVER uses very rough rating categories that can in themselves beinteresting. However, the numeric ratings, and especially the technique of summingthese ratings together into a single numeric rating, are flawed. CARVER’s simplenumeric scoring scheme does not accurately preserve important distinctions amongcategories. Also, there is little reason to believe that combining ratings of very differ-ent aspects of the problem (e.g., time, importance, physical measures, effects) willyield a meaningful numeric score.

______________ 13See, for example, U.S. Department of the Air Force (2000a,b,c); U.S. Naval Safety Center (1997); and U.S.Naval Safety Center, “Operational Risk Management” (webpage).14See, for example, the tutorial by the U.S. Naval Safety Center (n.d.).


Despite the problems with CARVER, the following basic steps of an IVA remain valid:

1. Identify vulnerabilities.

2. Prioritize vulnerabilities.

3. Brainstorm countermeasures.

4. Assess risks.

As with OPSEC and ORM, basic steps in CARVER parallel VAM in general, with theadded explicit representation of risk assessments. CARVER contains little guidanceon how to identify vulnerabilities, and “brainstorming” countermeasures are of littlehelp. Thus, the techniques in the VAM methodology for identifying vulnerabilitiesand exploring countermeasures are relevant to CARVER studies.

The VAM Methodology Techniques Fill Critical Needs in OtherMethodologies

While many of these methodologies (including VAM) use similar philosophies andguidelines (i.e., reviewing critical functions, identifying vulnerabilities, choosingmitigation techniques, implementing techniques, and testing for robustness underthreats), the VAM methodology complements the others in that it provides anexplicit mechanism to help an evaluator understand what leads to vulnerabilities,what security techniques apply to the vulnerabilities identified, and what potentialproblems may arise from the security techniques themselves. Given the good effortsby these organizations to institutionalize security reviews, it may make sense for theorganizations to adopt the methods in steps 3 and 4 of the VAM methodology as away to improve their own utility and provide detailed guidance to the evaluators intheir communities (see Figure 3.7).

RANDMR1601-3.7

• VAM Methodology1. Identify essential information functions2. Identify essential information systems3. Identify system vulnerabilities

4. Identify pertinent security techniques• VAM matching matrix tool

5. Apply techniques6. Test for robustness under threat

• IVA (Integrated Vulnerability Assessment)/CARVER

1. Identify vulnerabilities2. Prioritize (CARVER)3. Brainstorm countermeasures4. Risk assessment

• ORM (Operational Risk Management)

1.2.3.4.5.

• OPSEC (Operations Security)1.2.3.4.5.

Identify hazardsAssess hazardsMake risk decisionsImplement controlsSupervise

Identify critical informationAnalyze threatsAnalyze vulnerabilitiesAssess risksApply countermeasures

{

{Figure 3.7—The Core of the VAM Methodology Can Be Used in Other

Traditional Methodologies

25

Chapter Four

VULNERABILITY ATTRIBUTES OF SYSTEM OBJECTS

Here we present the lists and descriptions of vulnerability attributes, how they can bemapped in a user form to system objects, and how some common security problemsexploit these attributes. Thus, this chapter provides details on step 3 of the VAMmethodology.

VULNERABILITY ATTRIBUTE CATEGORIES

Figure 4.1 lists the general properties of objects that can lead to vulnerabilities. Vul-nerability attributes include those related to the design and architecture of the sys-tem, the behavior and actions taken by the system, and general attributes that cutacross both structure and behavior. These somewhat conceptual attributes applygenerally to many types of systems and at various levels within the systems.

Table 4.1 maps the attributes that can lead to vulnerabilities to all four types of sys-tem objects: physical, cyber, human/social, and supporting infrastructure. Attributesare grouped according to whether they arise from the design or architecture of thesystem object, from the behavior of the system object, or more generally from both.

A VULNERABILITY CHECKLIST AND EXAMPLE

Table 4.1 can be used as a checklist or form to be completed by the evaluator whenexamining the information system. In this way, he or she can review the entire list ofvulnerability attributes across all the object types for the system (or subsystem) beingstudied. Table 4.2 shows the checklist completed with the following common secu-rity concerns.

Insider Threat

Vulnerability Attribute: Malevolence.

Type of Target: Human/social.

Description: It is widely believed that the “insider threat” (malevolent behavior by atrusted person with approved access to critical information systems) is the greatestthreat to the security of information systems. The “insider” might be someone with agrudge, or co-opted by an enemy through blackmail, bribes, or the like.


RANDMR1601-4.1

•

•

•

•

•

•

•

•

••

•

•

•

••

•

–

–

–

Singularity

Uniqueness

Centrality

Homogeneity

Separability

Logic/implementation errors; fallibility

Design sensitivity, fragility, limits, finiteness

Unrecoverability

Behavioral sensitivity/ fragility

Malevolence

Rigidity

Malleability

Gullibility, deceivability, naiveté

Complacency

Corruptibility, controllability

Accessible, detectable, identifiable, transparent, interceptable

Hard to manage or control

Self-unawareness and unpredictability

Predictability

Design/Architecture Behavioral General

Figure 4.1—Properties Leading to Vulnerabilities

Inability to Handle Distributed Denial-of-Service Attacks

Vulnerability Attribute: Behavioral sensitivity/fragility.

Type of Target: Cyber.

Description: One of the most difficult kinds of cyber attacks to handle is the dis-tributed denial-of-service (DDoS) attack, wherein hundreds or thousands of differentcomputers bombard a specific network node or component with packets or requestsfor service—usually ones with erroneous information that require additional time forprocessing. Information networks must be specially configured and designed if theyare to thwart (to the extent possible) this kind of attack that depends on behavioralcharacteristics and sensitivities of the network(s).

IP Spoofing

Vulnerability Attribute: Gullibility/deceivability/naiveté.


Description: To “spoof” an Internet Protocol (IP) address, within a packet or mes-sage, means to substitute an erroneous address in the place where a valid one shouldappear. By this means, it becomes difficult to ascertain the true sender of an infor-mation packet or session, and therefore to permit various forms of attack that dis-guise their source.

Vulnerability Attributes of System Objects 27

Table 4.1

Matrix of Vulnerability Attributes and System Object Types

RANDMR1601-table4.1





authentication



Malevolence

Rigidity

Malleability


Complacency

Separability



Unrecoverability

Singularity

Attributes

Uniqueness

Centrality

Homogeneity

Des

ign/

Arc

hite

ctur

e




Self-unawarenessand unpredictability

Predictability

Beh

avio

rG

ener

al




Table 4.2

Example Completed Vulnerability Checklist

RANDMR1601-table4.2





authentication



Malevolence

Rigidity

Malleability


Complacency

Separability



Unrecoverability

Singularity

Attributes

Uniqueness

Centrality

Homogeneity

Des

ign/

Arc

hite

ctur

e




Self-unawarenessand unpredictability

Predictability

Beh

avio

rG

ener

al



Insider threat

IP spoofing

Inability to detect changes

Common commercialsoftware is well knownand predictable

Common commercialhardware is well knownand predictable

to IP net, making IP masking possible

Standardized software

Weaknesses in router or desktop applications software

Centralized Network Operations Centers (NOCs)

Electronic environmental tolerances

Inability to handle (DoS) attacks


Inability to Detect Changes to IP Net, Making IP Masking Possible

Vulnerability Attribute: Self-unawareness and unpredictability.


Description: If an IP network does not have active monitoring programs and tools toallow personnel to ascertain whether or not a new host (IP address) has beeninserted, or removed, from the net, then it could be possible for someone to insert anunauthorized laptop or another device onto a network connection and downloadinformation into that device. This danger is especially prevalent for wireless net-works, where the “connection” can be from a location away from visible networkports or even outside the organization’s building. This is a lack of “self-awareness” ofthe network configuration, and changes to it, during its operation.

Centralized Network Operations Centers

Vulnerability Attribute: Centrality.

Type of Target: Physical.

Description: Network operations centers can contain many vital physical compo-nents (e.g., key equipment and backups) in one central location. As such, a physicalattack could disable not only primary, but also backup, routers and key communica-tions equipment.

Common Commercial Software and Hardware Are Well Known andPredictable

Vulnerability Attribute: Predictability.

Type of Target: Physical and Cyber.

Description: The personal computers, workstations, routers, servers, and other com-ponents of critical information systems are often based heavily on commercial prod-ucts, such as Cisco router software, Windows NT, and Microsoft Outlook, Word,Excel, PowerPoint, etc. As such, the vulnerabilities, organization, and, in some cases,source code of these types of programs are widely known. The programs are thushighly predictable in that other copies of them can be tested to find situations (e.g.,exceeding the capacity of a database) in which their performance fails.

Standardized Software

Vulnerability Attribute: Homogeneity.



Description: The heavy use of standardized software for routers (e.g., Cisco operatingsystem), servers (e.g., Windows NT), and PCs/workstations (e.g., Windows NT orMacintosh OS) creates a very homogeneous information and communication sys-tem. Any flaw in one of these designs can be replicated widely within the informationsystem and therefore can provide a common vulnerability across the system.

Weaknesses in Router or Desktop Applications Software

Vulnerability Attribute: Logic/implementation errors; fallibility.


Description: There may be fundamental design or implementation flaws in standardsoftware used in operating systems (workstation and router) and desktop applica-tions. These flaws, if they become known to an attacker, could provide unauthorizedaccess or destruction.

Electronic Environmental Tolerances

Vulnerability Attribute: Design sensitivity/fragility/limits /finiteness.


Description: Various commercial electronic equipment vital to network communi-cations and computing are often not hardened for environmental influences (e.g.,temperature, smoke, humidity) or extreme attack means (e.g., electromagneticpulses [EMPs]).

DESCRIPTION OF VULNERABILITY ATTRIBUTES

Here are the attributes that lead to vulnerabilities, with short descriptions for each.Additional examples and discussions of these attributes can be found in Anderson etal. (1999).

Note that some vulnerabilities display more than one of these attributes at a time,often leading to a chain of attack or a series of faults to meet the ultimate goal of anattack or resulting in a non-intentional system failure.

Design and Architecture Attributes

The attributes of the design and architecture of a system object provide structuralcharacteristics that can lead to vulnerabilities. These attributes are grouped in thefollowing broad categories:

Singularity. Singularity is an important, broad category that can provide importanttargets or single points-of-failure with profound effects. Singularity encompassesuniqueness, centrality, and homogeneity.


• Uniqueness. Uniqueness is singularity in availability where an object may be theonly one of its kind. Besides being difficult to replace, unique objects may be lesslikely to have been thoroughly tested and perfected. Examples include one-of-a-kind items no longer being manufactured or people with special knowledge orexpertise that cannot be readily transferred to others.

• Centrality. Centrality is singularity in location where the failure points are col-lected in a single place. Examples include decisions, data, or control passingthrough a central node or process.

• Homogeneity. Homogeneity is singularity in type where, through replication,multiple, identical objects share common flaws or weaknesses. Using a singletype of object provides a common target that, if compromised, affects all thesystem functions it supports.

Grouping these three types under “singularity” recognizes that these attributes allexhibit singularity but in different ways. For example, a single point of failure may bedue to the difficulty in replacing it (uniqueness), the collection of critical nodes in asingle location (centrality), or the widespread compromise of a system once theweaknesses in a common object are discovered.

Separability. Separability implies that the object could easily be isolated from therest of the system. Separable objects are subject to divide-and-conquer attacks,where protection information (e.g., security updates), attack reinforcements, orpostattack repairs can be blocked or seriously delayed. Examples include networksthat can be bifurcated into two noncommunicating subnets.

Logic and Implementation Errors; Fallibility. Errors in the logic, implementation, orstructures of the system object can directly provide access, an exploitable target, ornon-attribution to an attacker. These errors can affect system reliability, availability,understandability, maintainability, and other important aspects. Errors and fallibili-ties can arise from failures to meet system requirements or, in more fundamentalflaws, in the requirements themselves. Errors and fallibilities can also arise frominsufficient validation, verification, and accreditation (VV&A); insufficient test andevaluation; lack of rigorous systems engineering; or from technical or scientific defi-ciencies or immaturities.

Design Sensitivity, Fragility, Limits, or Finiteness. Rather than flaws or errors, theseattributes arise from the natural limitations of all systems. No real-world system canbe designed with unlimited capacity and capability. Examples include vulnerabilityto environmental exposures, variations in inputs, abnormal use, and overloading.Appropriate error handling could mitigate these limitations, but vulnerabilities ensuewhen proper error handling is not implemented.

Unrecoverability. Objects that have irreplaceable components or information, aswell as those that require an inordinate time (relative to functional requirements) oreffort (relative to available resource) to recover from failure states or be replaced, canprovide a tempting target if they provide critical capabilities. Examples include sys-tems with long reboot times relative to operational response times and systems thatlose critical state information.


Behavioral Attributes

In addition to its structural features, an object’s behavior can exhibit characteristicsthat are exploitable. Here are the major behavioral attributes that can lead to suchvulnerabilities.

Behavioral Sensitivity or Fragility. These attributes involve how the object behavesor reacts, and how robust the object is to changes in input and environmental condi-tions. Examples include behavioral, functional, and operational sensitivity to actions,configurations, settings, inputs, etc.

Malevolence. Systems or people that actively work against the broader informationsystem and its security (e.g., insider threats) can directly damage the function of thesystem or be exploited by external entities to increase their malevolence.

Rigidity. Rigidity or lack of adaptiveness involves configurations, behaviors, orresponses not easily changed in response to an attack. Also, a lack of preplannedprocedures (e.g., contingency plans and MOUs1) can limit the available actions of anobject, making it more likely to fail or greatly slowing its function.

Malleability. Objects that can be easily modified, manipulated, changed, inserted, ordeleted pose potential weaknesses to both internal and external threats.

Gullibility, Deceivability, or Naiveté. Objects with these attributes are easy to fool.Examples include recruitable insiders, the inability to handle uncertain data, insuffi-cient trust models, the inability to recognize one’s own biases and when they canlead to duping, repudiation and lack of authentication, and the ability to be dupedinto an inappropriate response (i.e., being manipulated into a security state or pos-ture that is too high or low given the real threat, resulting respectively in less-effectiveoperations or insufficient protections).

Complacency. A lack of security diligence (e.g., poor administrative procedures orinsufficient screening) or responsiveness implies a weak security posture and an in-ability to respond to threats.

Corruptibility or Controllability. These attributes imply a weakness that can beexploited to make an object act in error or become a malevolent agent. Examplesinclude people that can be manipulated or corrupted into insider threats; inputs,outputs, and memory that can be changed; and systems or organizations that can becontrolled without the knowledge of their individual components.

General Attributes

These attributes cut across both the structure and behavior of the object.

______________ 1Memoranda of understanding (MOUs).


Accessible, Detectable, Identifiable, Transparent, or Interceptable. These exposuresapply to architecture, behavior, adaptations, data, etc., and form the basis of a criticalstep in an attack. Without access, for example, one cannot attack a system.

Hard to Manage or Control. Difficulty in configuring, controlling, or maintaining anobject or system can make it difficult to find, fix, or prevent flaws; establish propersecurity protections and responses; and bound the behavior of the system or itscomponents.

Self-Unawareness and Unpredictability. Just as knowledge is critical to an attacker,self-awareness is critical to the defender to know who and what constitutes the sys-tem, how it interconnects and interoperates, and how and when the system is beingcompromised. Likewise, the inability to predict how your system is configured or willbehave limits the knowledge available to respond to problems and attacks. Self-unawareness can also occur within the system itself (e.g., an inability to detect“alien” code within its own software).

Predictability. Predictability of the object’s design, architecture, or behavior by anadversary allows the adversary to plan and construct attacks from afar, to understandhow the object will respond, and to manipulate the object into desired states or fail-ure modes.

HOW VULNERABILITY PROPERTIES COMBINE IN COMMON THREATS

The following examples demonstrate how vulnerability properties can be combinedto provide significant information security problems.

First, consider DDoS attacks that take down an Internet service by flooding it withseemingly legitimate service requests from multiple, distributed sources. Figure 4.2shows that DDoS exploits design limits in traffic capacity, rigidity in rerouting andblocking incoming traffic, and difficulty in managing a system in which control isdistributed among multiple cooperating entities with no single management author-ity that regulates traffic.

Second, consider penetrations of firewalls set up to block illegitimate, untrusted, orunauthorized accesses and requests. Figure 4.3 shows that firewall penetrations cantake advantage of homogeneity in the global sense that market dominance and stan-dardization in firewalls, routers, and other network components make it easier toexploit known vulnerabilities in these components. Also, when an attacker deter-mines how to penetrate an organization with common firewalls, the attacker canpenetrate systems across the entire organization. Firewall penetrations also dependon accessibility vulnerabilities (e.g., presence on open networks), difficulty in firewalland network management (e.g., difficulties in configuring the firewalls initially or inreconfiguring the firewall to block known attackers), and self-unawareness (i.e.,when system operators do not know if their systems have been compromised, whothe penetrators are, what areas have been compromised, or even how their system isconfigured so they can adjust the configuration to block further penetrations).


RANDMR1601-4.2

•

•

•

•

•

•

•

•

••

•

•

•

••

•

–

–

–

Singularity

Uniqueness

Centrality

Homogeneity

Separability



Unrecoverability


Malevolence

Rigidity

Malleability


Complacency





Predictability

DDoS


Figure 4.2—Vulnerabilities Enabling Distributed Denial of Service

RANDMR1601-4.3

Singularity

– Uniqueness

–

–

Centrality

Homogeneity

Separability



Unrecoverability


Malevolence

Rigidity

Malleability


Complacency





Predictability

Firewallpenetration


•

•

•

•

•

•

•

•

••

•

•

•

••

•

Figure 4.3—Vulnerabilities Enabling Firewall Penetrations


Third, consider network mapping (e.g., using network scanning and probing tools)by an adversary to collect knowledge about the target system for future exploitation.Figure 4.4 shows that network mapping can take advantage of a large number of vul-nerabilities. Centrality provides “one-stop shopping” for information, making it eas-ier to find all the systems of interest. Homogeneity implies that the attacker canapply his or her knowledge across a large number of systems or even across thewhole organization. Rigidity keeps the network configuration very consistent, pre-serving the validity of whatever knowledge the adversary gathers. Gullibility allowsthe network mapper to employ deceptions to gather information (both from cyberprobes and from social engineering). Access to the system facilitates probes, open-source intelligence gathering, and social engineering. Difficulty in managing a net-work, along with unawareness, reduces the ability of the defender to keep out net-work probes and recognize when one’s system is the target of intelligence gathering.

RANDMR1601-4.4

Singularity

Uniqueness

Centrality

Homogeneity

Separability



Unrecoverability


Malevolence

Rigidity

Malleability


Complacency





Predictability

Networkmapping


•

•

•

•

•

•

•

•

••

•

•

•

••

•

–

–

–

Figure 4.4—Vulnerabilities Enabling Network Mapping


Finally, consider Trojan horse attacks on a computer system. Figure 4.5 shows thatTrojan horses exploit not only gullibility (the traditional concept from the story of theTrojan horse) but other vulnerabilities as well. A Trojan horse can enter a systemwhen gullible software trusts too much of the data submitted to it, gullible usersopen email attachments that appear suspicious to the trained eye, or gullible usersload software from uncertified sites. Homogeneity makes it easier to focus an attackon a single type of target and compromise systems across the organization. Control-lability allows the Trojan to take over computers and use them for other exploits andattacks. Self-unawareness prevents the user from detecting not only the initial Trojanhorse but also indicators that the computer has been compromised and is beingcontrolled for other purposes. Difficulty in managing one’s system implies that itmay be hard to reassert control and delete the Trojan once it has infected the system.Finally, accessibility allows the Trojan horse to present itself to the system or user inthe first place.

RANDMR1601-4.5

Singularity

Uniqueness

Centrality

Homogeneity

Separability



Unrecoverability


Malevolence

Rigidity

Malleability


Complacency





Predictability

Trojanhorse


•

•

•

•

•

•

•

•

••

•

•

•

••

•

–

–

–

Figure 4.5—Vulnerabilities Enabling Trojan Horse Attacks

37

Chapter Five

DIRECT AND INDIRECT SECURITY TECHNIQUES

This chapter provides an in-depth description of information system security tech-niques that help to mitigate vulnerabilities. Techniques are grouped according to thefundamental concepts they employ. These security technique categories are what thematrix and filters in step 4 recommend based on the types of vulnerability attributes,user role, and attack/failure stage in question.

The chapter ends by describing how some well-known security approaches rely onone or more of these fundamental categories.

SECURITY TECHNIQUE CATEGORIES AND EXAMPLES

The security field has identified and developed a large number of security tech-niques, employing various strategies to mitigate vulnerabilities. Some techniquesmake system objects resilient to attacks or failures. Other techniques enable activeidentification and response to attacks or failures. Additional techniques block criticalattack components or failure causes from reaching the object. Further techniquesdeter attackers from even trying an attack in the first place. Figure 5.1 lists the majortechniques of relevance to information system objects, grouped by whether theyimprove the resilience or robustness of the object from attack or failure, whether theyimprove knowledge and awareness of an attack or failure, whether they deny knowl-edge and awareness to an attacker, or whether they deter and punish attackers. Manyof these techniques overlap and complement each other, but the categories provideimportant distinctions and properties in and of themselves.

Resilience and Robustness

The first general category of security techniques involves making the system moreresilient and robust to attack.

Heterogeneity. Heterogeneity includes component types, operating ranges, manu-facturers, expertise, background, etc.; randomized compilation creating diversity;multimedia; and parallel heterogeneity (e.g., parallel email programs with synchro-nization).


RANDMR1601-5.1











acquisition


information/military operations• Criminal and legal penalties and


proceedings

Figure 5.1—Categories of Security Mitigation Techniques

Redundancy. Redundancy includes alternative systems and/or methods to accom-plish what a system does. The evaluator should also consider path diversity, bi- or n-connectedness, mirroring of databases, excess capacity, and stockpiling.

Centralization. Centralization includes the following: central collection of informa-tion, reporting, alerting, repairs, and updates to gain a common operating picture ofphysical systems, quality control, cost savings, etc.; and centralized location of man-agement (or virtual centralization via communications) to provide consistency,coordination, etc.

Decentralization. The evaluator should consider decentralized control points, rout-ing, backups, configuration data, repair points, staff; distributed, mobile processing;rotated responsibilities; and redundant information at different places.

VV&A, Software and Hardware Engineering, Evaluations, or Testing. The broad areaof rigorous design and engineering of information system components includesquality information system production; procedural certification (e.g., the CapabilityMaturity Model1); personnel and system testing, training, licensing, and certification;security procedures, checklists, and checks; security modeling, evaluation, and test-

______________ 1See www.sei.cmu.edu/cmm/.

Direct and Indirect Security Techniques 39

ing; red teaming (e.g., general security, intrusions, clearances, access); and exercises(real, simulated, tabletop).

Control of Exposure, Access, and Output. Controlling the boundary of the informa-tion system is the most common area of attention in information security. Tech-niques include cryptography, encryption, and public key infrastructures (PKIs);passwords, synchronized pseudorandom number generators; biometrics; smartcards; firewalls, filters, behavior limits; guards (ingress and egress); one-way gate-ways; backdoor elimination; uncopyable media or information; self-protecting pack-aging; air-gapped and off-line systems and backups; classification and compartmen-talization (insider access based on privileges, clearances, roles, capability, orbehavior); data, code, and process segmentation; wrapping trusted components(protect); wrapping, quarantining, or segregating untrusted components (controlbehavior and contain any damage); I/O checking (error checking, tight type andrange checking, etc.); physical security measures (e.g., electromagnetic shielding,fences, barriers, security guards, proper distance from barriers, locks, positive ornegative air pressure, etc.); using meta-data in support of classification,identification, and reasoning functions; nondisclosure during transit (encryption);and integrity verification.

Trust Learning and Enforcement Systems. Trust should be the basis of permittingaccess, acting on data, and using system components from others (e.g., software andfiles). Specific approaches include recording lessons learned, using consensus tech-niques, administering trust and experience surveys, collecting shared experience,and using trusted third parties to validate information and components.

Non-Repudiation. Techniques that prevent repudiation (and its earlier stage of attri-bution) include proof of receipt and ownership; authentication; PKI; and recordingall accesses, read/writes, and data sources (sign-in and sign-out logs, video monitor,access logs, meta-data structures, etc.).

Hardening. Hardening an object to withstand attacks that get through protectionscan be a final, yet important, stand. Approaches include hardened electronics; error-correcting codes and software; robust staff and procedures (even if only a subset ofcomponents remains to provide minimal capability); EMP, environmental, shock, orsurge-tolerant equipment; read-only (write-protect) data storage, configurations,network tables, etc.; and read-only memory (ROM).

Fault, Uncertainty, Validity, and Quality Tolerance and Graceful Degradation. Simi-lar to hardening, tolerance and graceful degradation allows the object to toleratefaults, uncertainty, invalidity, and poor quality by adjusting behavior and perfor-mance to accommodate the problems without failing. Techniques include separabil-ity (to allow isolation of faulty components); tolerance built into design andapproach; minimal ways to operate degraded equipment (e.g., running the fans in anair conditioner when the cooling components fail; running central processing units[CPUs] in protected modes or from minimal operating systems on disks with mini-mal extensions, graphics, etc.); ability to handle and reason with uncertain, partiallyreliable, and degraded data; accreditation of incoming information to quantify its


reliability or uncertainty; validity assessment; source verification; providing meta-data for data quality; and uncertainty reasoning and semantics.

Static Resource Allocation. Allocating resources in predefined ways allows time foradvanced planning, analyzing the consequences of changes, and looking at theirimplications for improving the system’s security posture. Approaches includerestricting nonessential connections; reducing load at weak points; and establishingand implementing guidelines related to known sensitivities of systems (e.g., in Win-dows systems, limiting the number of applications open at the same time; keepingthe use of unstable applications down to a minimum, especially at more criticaltimes in a mission).

Dynamic Resource Allocation. The adaptive partner to static resource allocation,dynamic resource allocation utilizes information about the threat or problem toadjust resources in or near real time, often involving complex and changingresponses. Techniques include load shedding (demand, throughput, heat, power,etc.); prioritizing clients or processes (e.g., market-based, managed priorities); cut-ting off offending traffic or allocations farther upstream; dynamic administrativeoverhead levels; dynamic network reconfiguration that is either manual or auto-mated, and rule-driven, case-based, or searched (e.g., genetic algorithms orexploratory modeling);2 keeping the use of unstable hardware or software down to aminimum at more critical times in a mission; and dynamic changes to provide un-predictability or deception.

General Management. Effective management can improve security through report-ing systems, structures, and procedures; quality control; ensuring that default set-tings meet security needs; peer pressure; information dissemination and advertising;training; security campaigns and reminders; warnings and threats; policy remindersand motivators; and red teaming to test and evaluate procedures and compliance.

Threat Response Structures and Plans. Information Conditions (INFOCONs) andother preplanned static and dynamic protective measures employ a hierarchy ofincreasing information system protective measures to be taken in response to antici-pated or observed attack threat levels. Other approaches include data and configura-tion protection and backup; establishment of backup servers; infrastructure backup;security plans and MOUs; crisis planning and management; purging and filtering;adaptive response to adaptive attacks; and resource reallocation.

Rapid Reconstitution and Recovery. The ability to reconstitute or recover after afailure can be almost as effective as not having failed in the first place if the responsetime is rapid enough relative to the performance needs of the system. Techniquesinclude data protection and recovery; warm rebooting; hot, warm, or cold backupservers; reserved and alternate channels to “reboot”; having reserve staff available

______________ 2For example, networks can be reconfigured to accommodate new loads, bypass unauthorized traffic, orfacilitate priority traffic based on available network management information. New configurations can beconstructed by employing heuristic rules, searching through prior cases, or searching over the space ofsimulated performance models (e.g., using exploratory modeling or genetic algorithms) to find a good re-configuration for the current condition.


(either directly or through MOUs with nearby organizations); giving each networknode a “genome” (predefined instruction set) for rebooting; infrastructure backupand recovery approaches; threat response plans (e.g., security plans, MOUs forprearranged coordination, or crisis planning and management); dynamic resourceallocation (e.g., purging and filtering); adaptive response to adaptive attacks; manualoperation and recovery plans; locally available replacement parts (possibly in differ-ent areas to provide a decentralized target); rapid replacement plans; local repaircapabilities; and examining what hardware, software, and data are the hardest to re-generate (and thus need to be preserved or made redundant).

Adaptability and Learning. Adversaries continually learn about targets and adapt tochanging defenses. A defender, therefore, must adapt to these changing threats orrun the risk of being outpaced by a creative adversary that can simply bypass thedefender’s “Maginot Line.”3 Techniques include building adaptive responses to un-known or adaptive attacks; extracting lessons learned and creating best securitypractices databases (a gross “immunological system” from one perspective);leveraging centralization to improve dissemination of lessons learned about attacks;mining attack data to learn what the adversary is doing, develop protective actions,and develop countermeasures; ensuring sufficient monitoring and tracking to informlearning; developing available (rapid) training materials and critical data materials,especially on the critical operations and procedures for rapid use by secondary staff;and establishing dynamic INFOCONs and other threat response structures andplans.

Immunological Defense Systems. Borrowing from biology, an “immunological” sys-tem incorporates threat recognition, mitigation development, implementation, anddissemination across the system and organization. Techniques include automatic(preferred) or manual systems to detect threats, spread warnings, install updates orpatches, and enact security measures; automatic commercial off-the-shelf (COTS)patch and profile data updates; memory, adaptation, and communication (requires areporting structure); sharing information globally on attacks to piece together what ishappening and how to respond; and applying concepts to develop adaptive andshared INFOCON procedures.

Vaccination. Another concept inspired by biology involves the deliberate attack(“infection”) to train, recognize, sensitize, and prepare for future attacks (with orwithout a formal “immunological system”). Red teaming to sensitize the system isone such approach.

______________ 3The Maginot Line was a French network of defensive weapon emplacements and supporting tunnelsdesigned to thwart potential physical attacks along the German boarder after World War I. The conceptproved obsolete in World War II because of Germany’s ability to rapidly end-run the line and attack froman unprotected angle.


Intelligence, Surveillance, Reconnaissance, and Self-Awareness

The second general category of security techniques involves collecting informationabout the threat and one’s own system—in a sense, the “intelligence preparation ofthe battlefield.”

Intelligence Operations. Intelligence involves the full range of information gatheringabout opponent (goals, thrusts, methods, capabilities, etc.) and insider operations.Ideally, intelligence covers both your and your opponent’s information systems,since they constitute the “battlespace.” Intelligence not only can detect attacks butcan also gather advanced information that can inform protective and reactive proce-dures.

Self-Awareness, Monitoring, and Assessments. Knowing about your own system,being able to monitor it, and assessing its condition is often a critical step in recog-nizing and then mitigating attacks and failures. Techniques include self-monitoring(insider or outsider threats); security audits (e.g., the VAM methodology and IVA); redteaming to gather information; network monitoring and management tools; stateand performance monitors; documentation of your system’s configurations andstates; static modeling and understanding; monitoring and recording the behavior ofapplications and staff (data accessed or changed; connections; requests; functionsexecuted; accesses attempted; etc.); and providing capabilities for remote monitoringfrom centralized locations for expert consultations and monitoring.

Deception for ISR. Deception can be a useful (and unexpected) technique for intelli-gence, surveillance, and reconnaissance (ISR), since by its very nature deceptionaffects information flow. Techniques include sting and intelligence operations usinghoneypots, cutouts, zombies, decoys, disguise, structural or behavioral mimicry, etc.4

Attack Detection, Recognition, Damage Assessment, and Forensics (Self and Foe).Various methods are available to detect, recognize, and analyze attacks, as well asassess the scope of the damage from these attacks. Techniques include real-timeintrusion detection; learning systems (neural nets, self-organizing maps, etc.); pat-tern recognition (case-based, rule-based, model-based correlation, etc.); self-/non-self-discrimination; internal system behavior and condition monitoring; deceptionfor detection and recognition (e.g., spoofing, canaries, honeypots); tamper and un-sealing detection; tracking and tracing; special monitoring privileges; corruptionrecognition; use of design specifications to bound acceptable hardware, software,and staff behavior; tamper-evident barriers; non-repudiation mechanisms (e.g.,modification records, proofs of receipt and ownership, authentication, PKI); accesslogs; and global sharing of intelligence data to aid in analysis.

______________ 4See Gerwehr and Glenn (2000, Chapter 3) for a review of general deception techniques.


Counterintelligence; Denial of ISR and Target Acquisition

The third general category of security techniques involves CI, as well as denying ISRand target acquisition to your adversary—directly affecting your adversary’s ability togather required knowledge about your system for an attack.

General CI. Some basic CI techniques for information systems include scans forphysical monitors, bugs, etc.; scans for software Trojan horses and monitors; securitychecks; and polygraphs.

Unpredictable to Adversary. Making your system unpredictable prevents the adver-sary from making educated guesses about your system based on industry standardconfigurations and components. Techniques include pseudorandomization and un-common configurations, names, locations, equipment, responsibilities, etc.; extremeheterogeneity or decentralization; removing documentation; self-organizing collec-tive behavior; goal-oriented behavior; specialization; adaptive, threat-based, or rule-based activity; communication among individuals; beneficial emergent behavior un-predictable by outsiders (or even insiders); and varied operating procedures(hardware, software, staff).

Deception for CI. As with ISR, deception can be a useful (and unexpected) techniquefor CI by interrupting information flow to the adversary. Deception techniques for CIinclude masking an item and its particular vulnerabilities; masking real and puttingout false architecture, design, and plan information; and misleading or confusing theadversary. Masking involves camouflage; low observables; mislabeling; removinglabels; producing false associated plans, procedures, instructions, data, or otherinformation; network anonymizers (anonymous searches, IP spoofing, etc.); emis-sion shielding; power controls; and behavioral camouflage or mimicry (acting morelike something that is not a target). Misleading involves stings; cutouts and zombies;decoys; disguises, mimicry (looking more like something that is not a target but isalso not noise); honeypots; disinformation (e.g., locations, capabilities, configura-tions, procedures, vulnerabilities, etc.); bluffs and feints; and disinformation. Confus-ing involves oversaturation; paralyzing uncertainty; “shoot-and-scoot”; making anattack seem easier than it really is; producing a false sense of security in the adver-sary; and disinformation.

Denial of ISR and Target Acquisition. Direct denial techniques include movement,shielding or access filters, and jamming.

Deterrence and Punishment

The last general category of security techniques involves intimidating adversaries toreduce their willingness to attack your system in the first place.

Deterrence. Various deterrence techniques for information systems include crediblethreats; shows of force; warnings, peer pressure, psychological operations (PsyOps),and tamper-evident and damage-evident devices (e.g., tape, tabs, indicators); andproper management of the implementation of deterrence.


Preventive and Retributive Information/Military Operations. Offensive IO5 andmilitary operations can be used as preventive and retributive responses to attacksfrom adversaries. Operation aspects include information dissemination, PsyOps,electronics warfare, physical attack, and information attack.

Criminal and Legal Penalties and Guarantees. Techniques that can be employedinclude bonding; guarantees; warrantees; international treaties and agreements; uti-lize non-repudiation data; and penalties for attacks and damage (including by insid-ers).

Law Enforcement; Civil Proceedings. Finally, enforcement of laws is important; oth-erwise their threats will be hollow. Enforcement aspects include international,national, state, and local authorities and courts; utilizing non-repudiation data; andproper follow-through and management.

HOW SECURITY TECHNIQUES COMBINE IN COMMON SECURITYAPPROACHES

The following examples demonstrate how the fundamental mitigation techniqueslisted above are combined in common security approaches.

First, consider INFOCONs. Figure 5.2 shows that the INFOCON concept is an objec-tive threat response (or preparation) plan that allows advanced analysis andarrangements. However, effective use of INFOCONs also relies on the ability tomonitor and assess one’s own system to understand what the threat really is and toensure that the INFOCON level is neither too low nor too high given the real threat.The monitoring and assessment aspect is important to prevent the known concernthat the INFOCON level may be set too high, incurring reduced system performancedue to heightened security.

Second, consider “Indications and Warning” (I&W) systems that provide intelligenceon attacks. Figure 5.3 shows that I&W relies on a whole host of ISR and self-aware-ness techniques. The current state of I&W for IO relies mostly on monitoring anddetection techniques within the defender’s systems (e.g., intrusion-detection sys-tems, network monitors, deception techniques) rather than on intelligence opera-tions in the general Internet or in an adversary’s organizations and computer sys-tems.

Third, consider Computer Emergency Response Teams (CERTs) and other relatedcenters that coordinate computer security, conduct vulnerability and threat analyses,provide advisories, organize and plan security responses, and implement responses(both planned and ad hoc) during attacks.6 Figure 5.4 shows that CERTs employ

______________ 5Information operations can also be referred to as information warfare (IW).6Example CERTs include the “CERT® Coordination Center” (CERT®CC) (www.cert.org), DoD-CERT(www.cert.mil), Army Computer Emergency Response Team (ACERT), and AIR FORCE Computer Emer-gency Response Team (AFCERT). Related centers include the Federal Computer Incident Response Center(FedCIRC) (www.fedcirc.gov), the National Infrastructure Protection Center (NIPC) (www.nipc.gov), Naval


RANDMR1601-5.2











acquisition




proceedings

INFOCONs

Figure 5.2—Security Techniques Supporting INFOCONs

RANDMR1601-5.3











acquisition




proceedings I&W

Figure 5.3—Security Techniques Supporting I&W

Computer Incident Response Team (NAVCIRT), and the NASA Incident Response Center (NASIRC) (www-nasirc.nasa.gov).


RANDMR1601-5.4











acquisition




proceedings CERTs

Figure 5.4—Security Techniques Supporting CERTs

centralization to coordinate monitoring, security procedures and other information,security responses, management, and communications against attacks.

Fourth, consider firewalls that filter information and requests for service coming intoa local network based on predefined (and sometimes adaptive) profiles. Figure 5.5shows that firewalls directly implement a primary means of controlling exposure,access, and information output, but effective firewall maintenance depends on cur-rent intelligence, assessments of threats, and knowledge of what is happening withinone’s system.

Fifth, consider encryption and PKIs. Figure 5.6 shows that they provide a criticaltechnical means for controlling exposure, access, and output by verifying identityand controlling exposure of information during transit.


RANDMR1601-5.5











acquisition




proceedings Firewalls

Figure 5.5—Security Techniques Used in Firewalls

RANDMR1601-5.6











acquisition




proceedings Encryption/PKI

Figure 5.6—Security Technique Incorporating Encryption and PKIs


Finally, consider isolation and air-gapped networks. Figure 5.7 shows that isolationand air gapping are other technical means for controlling exposure, access, and out-put. The most critical information systems often use these approaches, since elec-tronic filters, firewalls, and encryption schemes can be compromised with enougheffort. Air gapping raises the level of security so that other access means have to bedeveloped by the adversary (e.g., developing physical access, using insiders, or so-called “chipping” in which physical devices are inserted or modified to facilitatefuture access or damage).

RANDMR1601-5.7











acquisition




proceedings Isolation; air-gapped nets

Figure 5.7—Security Technique Incorporating Isolation of Systems

49

Chapter Six

GENERATING SECURITY OPTIONS FOR VULNERABILITIES

This chapter describes how step 4 of the VAM methodology maps the vulnerabilitiespresented in Chapter Four to the security techniques presented in Chapter Five toprovide specific guidance on how to address identified vulnerabilities. Next, thechapter describes filtering techniques that improve the appropriateness of thesecurity techniques identified in the matrix to a particular user type and attack stage.Chapters Five and Six describe step 4 of the methodology and support the selectionof security techniques (step 5). Finally, the chapter provides specific examples of thekinds of specific security countermeasures that can be identified for specific, com-mon information system vulnerabilities by an operational evaluator employing themethodology.

MAPPING VULNERABILITIES TO SECURITY TECHNIQUES

Once the often-challenging task of identifying both known and unknown vulnera-bilities has been achieved, the evaluator must identify which of the many securitytechniques identified in Chapter Five are relevant to the vulnerabilities from ChapterFour identified during the evaluation. Rather than leaving this task to unguidedpersonal intuition or blind brainstorming, the VAM methodology guides theevaluator by explicitly identifying in a matrix which security techniques are relevantfor each vulnerability attribute.

Security Techniques That Address Vulnerabilities

Table 6.1 shows the large matrix in the methodology that relates vulnerability prop-erties (see Chapter Four) along the left column to the security techniques (see Chap-ter Five) across the top row. The kinds of relationships between individual vulnera-bility properties and security techniques are represented by numeric values (see Fig-ure 6.1). These numeric values were determined by experience and judgment aboutthe logical relationships between broad categories of vulnerabilities and techniques.The reasoning behind each value is documented in the Appendix.

Utopia Utopia Semibold

Table 6.1

The Vulnerability to Security Technique Matrix

RANDMR1601-table6.1

Resilie

nce / R

obustnes

s

Heter

ogeneit

yRed

undancy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A, SW

/HW

Engin

eerin

g, Eva

luat

ions,

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

Non-Rep

udiatio

n

Harden

ing

Fault,

Uncerta

inty,

Validity

, and Q

uality

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

over

y

Adapta

bility a

nd Lea

rnin

g

Imm

unologica

l Def

ense

Sys

tem

s

Vaccin

atio

n

Inte

lligen

ce O

perat

ions

Self-A

waren

ess,

Monitorin

g, and A

sses

smen

ts

Decep

tion fo

r ISR

Attack

Det

ectio

n, Rec

ognition, D

amag

e

Asses

smen

t, and F

orensic

s (Self

and F

oe)

Gener

al Counte

r-Inte

lligen

ce

Unpredict

able

to A

dvers

ary

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Preve

ntive a

nd Ret

ributiv

e Info

rmat

ion /

Militar

y Oper

atio

ns

Crimin

al an

d Leg

al Pen

alties

and G

uaran

tees

Law E

nforc

emen

t; Civi

l Pro

ceed

ings

Trust, Authentication, and Access

Management

Singularity 2 2 2 1 -1 2 2 2 1 1 2 2 1 1 1 2 2 2Uniqueness 2 2 2 1 1 2 2 2 2 1 1 1 -1 2 2Centrality 2 1 1 0 -2 2 2 2 -1 1 1 2 2 -1 -1 1 -2 2 -1 1 0 1 -1Homogeneity 2 2 1 -1 1 2 1 2 2 0 0 1 -2 -1 0 0 -1 0 -1

Separability 2 -1 2 -2 2 1 -2 1 -1 1 2 -2 -1 2 -2 1 1 1Logic / Implementation Errors; Fallibility

2 2 1 1 -1 2 2 1 2 2 1 1 2 1 -1 1 2 2 2


2 2 -1 2 1 2 -1 2 2 -1 2 -1 2 -1 2 2 2 -1 1 -1 1 1 1 1

Unrecoverability 2 2 2 1 2 2 1 -1 2 2 1 1 1 1 2 1 1 1

Behavioral Sensitivity / Fragility

2 2 -1 2 -1 1 2 -1 2 2 -1 2 2 2 2 -1 2 1 -1 1 1 -1 1 1

Malevolence 1 1 1 2 2 2 2 2 1 1 1 -1Rigidity 2 1 -2 1 2 -2 2 -2 2 1 -2 2 2 -1 2 -2 2 2 2 2Malleability 1 1 1 -1 2 1 2 -1 1 2 1 -1 -1 2 2 1 -1 -1Gullibility / Deceivability / Naiveté

-1 2 1 -1 2 -1 1 2 1 -2 -1 2 -1 2 -2 2 -1 1 2

Complacency 2 1 -1 2 -1 1 -1 2 -1 -1 -1 -1 -1 2 -1 2 -1 2 -1 -1 2 2 -1 1Corruptibility / Controllability

2 1 1 -1 1 2 2 -1 2 1 2 -1 2 2 -1 1 -1


2 1 1 -2 2 2 2 2 2 2 1 2 -1 1 1


-2 -1 2 -2 2 2 -1 2 -1 2 2 -1 2 2 -1 1


-2 2 -2 2 -1 2 -1 -1 1 1 -1 1 1 -1 -1 2 2

Predictability 2 -1 1 2 -1 1 -1 -1 -2 2 -1 1 -1 1 -1 2 2 -1 1 -1


Management


Gen

eral

Att

ribu

tes

Lea

din

g t

o V

uln

erab

iliti

es

Des

ign

/ A

rch

itec

ture

Beh

avio

r

Resilie

nce / R

obustnes

s

Heter

ogeneit

yRed

undancy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A, SW

/HW

Engin

eerin

g, Eva

luat

ions,

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

Non-Rep

udiatio

n

Harden

ing

Fault,

Uncerta

inty,

Validity

, and Q

uality

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

over

y

Adapta

bility a

nd Lea

rnin

g

Imm

unologica

l Def

ense

Sys

tem

s

Vaccin

atio

n

Inte

lligen

ce O

perat

ions

Self-A

waren

ess,

Monitorin

g, and A

sses

smen

ts

Decep

tion fo

r ISR

Attack

Det

ectio

n, Rec

ognition, D

amag

e

Asses

smen

t, and F

orensic

s (Self

and F

oe)

Gener

al Counte

r-Inte

lligen

ce

Unpredict

able

to A

dvers

ary

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Preve

ntive a

nd Ret

ributiv

e Info

rmat

ion /

Militar

y Oper

atio

ns

Crimin

al an

d Leg

al Pen

alties

and G

uaran

tees

Law E

nforc

emen

t; Civi

l Pro

ceed

ings

1 1 1 1 1 11 1 1 1 1 1 11 -1 1 -1 0 -1 -1 1 1 1 1 2 0

1 1 1 1 11 -1 2 0 -1 1 -1 1 -1 1 -1 1

1 1 1 1 1 1 1

1 2 0 1 1 1 1 1 1 1

1 2 1 1 1 1 1 1 1

1 2 1 1 -1 1 -1 1 -1 1 1 1

2 2 2 2 2 2 2 2 2 2 2 21 1 1 1 1 1 -12 1 1 1 1 1 2 1

2 2 1 1 -1 1 -1 1 1

2 -1 2 -1 1 1 1 1 2 -1 1 -1 -1

2 2 1 1 1 1 2 1

1 1 -1 1 2 2 2 2 2 2 1 1

2 -1 1 -1 -1 -1 1 1 1

2 -1 2 1 1 -2 1 -2

0 1 2 2 2 2 -1



Resilie

nce / R

obustnes

s

Heter

ogeneit

yRed

undancy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A, SW

/HW

Engin

eerin

g, Eva

luat

ions,

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

Non-Rep

udiatio

nHar

denin

g

Fault,

Uncerta

inty,

Validity

, and Q

uality

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

over

y

Adapta

bility a

nd Lea

rnin

g

Imm

unologica

l Def

ense

Sys

tem

s

Vaccin

atio

n

Inte

lligen

ce O

perat

ions

Self-A

waren

ess,

Monitorin

g, and A

sses

smen

ts

Decep

tion fo

r ISR

Attack

Det

ectio

n, Rec

ognition, D

amag

e

Asses

smen

t, and F

orensic

s (Self

and F

oe)

Gener

al Counte

r-Inte

lligen

ce

Unpredict

able

to A

dvers

ary

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Preve

ntive a

nd Ret

ributiv

e Info

rmat

ion /

Militar

y Oper

atio

ns

Crimin

al an

d Leg

al Pen

alties

and G

uaran

tees

Law E

nforc

emen

t; Civi

l Pro

ceed

ings


Management

Singularity 2 2 2 1 –1 2 2 2 1 1 2 2 1 1 1 2 2 2Uniqueness 2 2 2 1 1 2 2 2 2 1 1 1 –1 2 2Centrality 2 1 1 0 –2 2 2 2 –1 1 1 2 2 –1 –1 1 –2 2 –1 1 0 1 –1Homogeneity 2 2 1 –1 1 2 1 2 2 0 0 1 –2 –1 0 0 –1 0 –1

Separability 2 –1 2 –2 2 1 –2 1 –1 1 2 –2 –1 2 –2 1 1 1Logic/ Implementation Errors; Fallibility

2 2 1 1 –1 2 2 1 2 2 1 1 2 1 –1 1 2 2 2

Design Sensitivity/ Fragility/Limits/ Finiteness

2 2 –1 2 1 2 –1 2 2 –1 2 –1 2 –1 2 2 2 –1 1 –1 1 1 1 1

Unrecoverability 2 2 2 1 2 2 1 –1 2 2 1 1 1 1 2 1 1 1

Behavioral Sensitivity/Fragility

2 2 –1 2 –1 1 2 –1 2 2 –1 2 2 2 2 –1 2 1 –1 1 1 –1 1 1

Malevolence 1 1 1 2 2 2 2 2 1 1 1 –1Rigidity 2 1 –2 1 2 –2 2 –2 2 1 –2 2 2 –1 2 –2 2 2 2 2Malleability 1 1 1 –1 2 1 2 –1 1 2 1 –1 –1 2 2 1 –1 –1Gullibility/ Deceivability/ Naiveté

–1 2 1 –1 2 –1 1 2 1 –2 –1 2 –1 2 –2 2 –1 1 2

Complacency 2 1 –1 2 –1 1 –1 2 –1 –1 –1 –1 –1 2 –1 2 –1 2 –1 –1 2 2 –1 1Corruptibility/ Controllability 2 1 1 –1 1 2 2 –1 2 1 2 –1 2 2 –1 1 –1

Accessible/ Detectable/ Identifiable/ Transparent/ Interceptable

2 1 1 –2 2 2 2 2 2 2 1 2 –1 1 1


–2 –1 2 –2 2 2 –1 2 –1 2 2 –1 2 2 –1 1


–2 2 –2 2 –1 2 –1 –1 1 1 –1 1 1 –1 –1 2 2

Predictability 2 –1 1 2 –1 1 –1 –1 –2 2 –1 1 –1 1 –1 2 2 –1 1 –1


Management


Gen

eral

Att

ribu

tes

Lea

din

g t

o V

uln

erab

iliti

es

Des

ign

/Arc

hit

ectu

reB

ehav

ior

Rapid

Rec

onstitu

tion an

d Rec

over

y

Adapta

bility a

nd Lea

rnin

g

Imm

unologica

l Def

ense

Sys

tem

s

Vaccin

atio

nIn

tellig

ence

Oper

atio

ns

Self-A

waren

ess,

Monitorin

g, and A

sses

smen

ts

Decep

tion fo

r ISR

Attack

Det

ectio

n, Rec

ognition, D

amag

e

Asses

smen

t, and F

orensic

s (Self

and F

oe)

Gener

al Counte

r-Inte

lligen

ce

Unpredict

able

to A

dvers

ary

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Preve

ntive a

nd Ret

ributiv

e Info

rmat

ion /

Militar

y Oper

atio

ns

Crimin

al an

d Leg

al Pen

alties

and G

uaran

tees

Law E

nforc

emen

t; Civi

l Pro

ceed

ings

1 1 1 1 1 11 1 1 1 1 1 11 –1 1 –1 0 –1 –1 1 1 1 1 2 0

1 1 1 1 11 –1 2 0 –1 1 –1 1 –1 1 –1 1

1 1 1 1 1 1 1

1 2 0 1 1 1 1 1 1 1

1 2 1 1 1 1 1 1 1

1 2 1 1 –1 1 –1 1 –1 1 1 1

2 2 2 2 2 2 2 2 2 2 2 21 1 1 1 1 1 –12 1 1 1 1 1 2 1

2 2 1 1 –1 1 –1 1 1

2 –1 2 –1 1 1 1 1 2 –1 1 –1 –1

2 2 1 1 1 1 2 1

1 1 –1 1 2 2 2 2 2 2 1 1

2 –1 1 –1 –1 –1 1 1 1

2 –1 2 1 1 –2 1 –2

0 1 2 2 2 2 –1



NOTE: The key for this table is in Figure 6.1.

50F

ind

ing an

d F

ixing V

uln

erabilities in

Info

rmatio

n System

s: VA

M M

etho

do

logy

Generating Security Options for Vulnerabilities 51

RANDMR1601-6.1

Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g; Eva

luat

ions;

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

N

on-Rep

udiatio

n

Harden

ing

Fault,

Unce

rtain

ty, Vali

dity, a

nd Quali

ty

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

overy

Adapta

bility a

nd Lea

rnin

g

Im

munolo

gical D

efen

se S

yste

ms

Vaccin

atio

n

In

tellig

ence

Oper

atio

ns

S

elf-A

waren

ess,

Monitorin

g, and

A

sses

smen

ts

D

ecep

tion fo

r ISR

A

ttack

Det

ectio

n, Rec

ognition, D

amag

e

A

sses

smen

t, an

d Fore

nsics (

Self an

d

Foe) Gener

al Counte

r-Inte

lligen

ce

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Operat

ions




2 1 1 -1 2 2 1 2 2 1 1 2 1 -1 1 2 2 2


2 -1 2 1 2 -1 2 2 -1 2 -1 2 -1 2 2 2 -1 1 -1 1 1 1 1


BehavioralSensitivity / Fragility

2 -1 2 -1 1 2 -1 2 2 -1 2 2 2 2 -1 2 1 -1 1 1 -1 1 1

Malevolence 1 1 1 2 2 2 2 2 1 1 1 -1Rigidity 1 -2 1 2 -2 2 -2 2 1 -2 2 2 -1 2 -2 2 2 2 2Malleability 1 1 1 -1 2 1 2 -1 1 2 1 -1 -1 2 2 1 -1 -1Gullibility / Deceivability / Naiveté

-1 2 1 -1 2 -1 1 2 1 -2 -1 2 -1 2 -2 2 -1 1 2

Complacency 1 -1 2 -1 1 -1 2 -1 -1 -1 -1 -1 2 -1 2 -1 2 -1 -1 2 2 -1 1Corruptibility / Controllability

1 1 -1 1 2 2 -1 2 1 2 -1 2 2 -1 1 -1


1 1 -2 2 2 2 2 2 2 1 2 -1 1 1


-2 -1 2 -2 2 2 -1 2 -1 2 2 -1 2 2 -1 1


-2 2 -2 2 -1 2 -1 -1 1 1 -1 1 1 -1 -1 2 2

Predictability 2 -1 1 2 -1 1 -1 -1 -2 2 -1 1 -1 1 -1 2 2 -1 1 -1



Gen

eral

Pro

per

ties

Lea

din

g t

o V

uln

erab

iliti

es

Des

ign

/ A

rch

itec

ture

Beh

avio

r

Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g; Eva

luat

ions;

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

N

on-Rep

udiatio

n

Harden

ing

Fault,

Unce

rtain

ty, Vali

dity, a

nd Quali

ty

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

overy

Adapta

bility a

nd Lea

rnin

g

Im

munolo

gical D

efen

se S

yste

ms

Vaccin

atio

n

In

tellig

ence

Oper

atio

ns

S

elf-A

waren

ess,

Monitorin

g, and

A

sses

smen

ts

D

ecep

tion fo

r ISR

A

ttack

Det

ectio

n, Rec

ognition, D

amag

e

A

sses

smen

t, an

d Fore

nsics (

Self an

d

Foe) Gener

al Counte

r-Inte

lligen

ce

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Operat

ions

1 1 1 1 11 1 1 1 1 11 -1 1 -1 0 -1 -1 1 1 1 2 0

1 1 1 11 -1 2 0 -1 1 -1 1 -1 1

1 1 1 1 1 1

1 2 0 1 1 1 1 1 1

1 2 1 1 1 1 1 1

1 2 1 1 -1 1 -1 1 1 1

2 2 2 2 2 2 2 2 2 2 21 1 1 1 1 -12 1 1 1 1 2 1

2 2 1 1 -1 1 1

2 -1 2 -1 1 1 1 2 -1 1 -1 -1

2 2 1 1 1 2 1

1 1 -1 1 2 2 2 2 2 1 1

2 -1 1 -1 -1 1 1 1

2 -1 2 1 1 -2

0 1 2 2 2 -1



Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g; Eva

luat

ions;

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

N

on-Rep

udiatio

n

Harden

ing

Fault,

Unce

rtain

ty, Vali

dity, a

nd Quali

ty

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

overy

Adapta

bility a

nd Lea

rnin

g

Im

munolo

gical D

efen

se S

yste

ms

Vaccin

atio

n

In

tellig

ence

Oper

atio

ns

S

elf-A

waren

ess,

Monitorin

g, and

A

sses

smen

ts

D

ecep

tion fo

r ISR

A

ttack

Det

ectio

n, Rec

ognition, D

amag

e

A

sses

smen

t, an

d Fore

nsics (

Self an

d

Foe) Gener

al Counte

r-Inte

lligen

ce

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Operat

ions




2 1 1 -1 2 2 1 2 2 1 1 2 1 -1 1 2 2 2


2 -1 2 1 2 -1 2 2 -1 2 -1 2 -1 2 2 2 -1 1 -1 1 1 1 1



2 –1 2 –1 1 2 –1 2 2 –1 2 2 2 2 –1 2 1 –1 1 1 –1 1 1

Malevolence 1 1 1 2 2 2 2 2 1 1 1 –1Rigidity 1 –2 1 2 –2 2 –2 2 1 –2 2 2 –1 2 –2 2 2 2 2Malleability 1 1 1 –1 2 1 2 –1 1 2 1 –1 –1 2 2 1 –1 –1Gullibility/

Deceivability/ Naiveté

–1 2 1 –1 2 –1 1 2 1 –2 –1 2 –1 2 –2 2 –1 1 2

Complacency 1 –1 2 -1 1 –1 2 –1 –1 –1 –1 –1 2 –1 2 –1 2 –1 –1 2 2 –1 1Corruptibility/ Controllability 1 1 –1 1 2 2 –1 2 1 2 –1 2 2 –1 1 –1Accessible/

Detectable/ Identifiable/ Transparent/ Interceptable

1 1 –2 2 2 2 2 2 2 1 2 –1 1 1

Hard to Manage or Control –2 –1 2 –2 2 2 –1 2 –1 2 2 –1 2 2 –1 1


–2 2 –2 2 –1 2 –1 –1 1 1 –1 1 1 –1 –1 2 2

Predictability 2 –1 1 2 –1 1 –1 –1 –2 2 –1 1 –1 1 –1 2 2 –1 1 –1



Gen

eral

Pro

per

ties

Lea

din

g t

o V

uln

erab

iliti

es

Des

ign

/ A

rch

itec

ture

Beh

avio

r

Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g; Eva

luat

ions;

Test

ing

Control o

f Exp

osure

, Acc

ess,

and O

utput

Trust

Lea

rnin

g and E

nforc

emen

t Sys

tem

s

N

on-Rep

udiatio

n

Harden

ing

Fault,

Unce

rtain

ty, Vali

dity, a

nd Quali

ty

Toler

ance

and G

race

ful D

egra

datio

n

Static

Res

ource A

lloca

tion

Dynam

ic Res

ource A

lloca

tion

Gener

al Man

agem

ent

Threat

Res

ponse S

truct

ures a

nd Plan

s

Rapid

Rec

onstitu

tion an

d Rec

overy

Adapta

bility a

nd Lea

rnin

g

Im

munolo

gical D

efen

se S

yste

ms

Vaccin

atio

n

In

tellig

ence

Oper

atio

ns

S

elf-A

waren

ess,

Monitorin

g, and

A

sses

smen

ts

D

ecep

tion fo

r ISR

A

ttack

Det

ectio

n, Rec

ognition, D

amag

e

A

sses

smen

t, an

d Fore

nsics (

Self an

d

Foe) Gener

al Counte

r-Inte

lligen

ce

Decep

tion fo

r CI

Denial

of I

SR & Ta

rget

Acq

uisitio

n

Deter

rence

Operat

ions

1 1 1 1 11 1 1 1 1 11 -1 1 -1 0 -1 -1 1 1 1 2 0

1 1 1 11 -1 2 0 -1 1 -1 1 -1 1

1 1 1 1 1 1

1 2 0 1 1 1 1 1 1

1 2 1 1 1 1 1 1

1 2 1 1 –1 1 –1 1 1 1

2 2 2 2 2 2 2 2 2 2 21 1 1 1 1 –1

2 1 1 1 1 2 1

2 2 1 1 –1 1 1

2 –1 2 –1 1 1 1 2 –1 1 –1 –1

2 2 1 1 1 2 1

1 1 –1 1 2 2 2 2 2 1 1

2 –1 1 –1 –1 1 1 1

2 –1 2 1 1 –2

0 1 2 2 2 –1



Heter

ogeneit

y

Redundan

cy

Centra

lizat

ion

Decen

traliz

atio

n

VV&A; SW

/HW

Engin

eerin

g;

Evalu

atio

ns; T

estin

g


Singularity 2 2 1 -1 2 2Uniqueness 2 2 1 1 2

Centrality 1 1 0 –2 2 2

Homogeneity 2 1 –1 1 2Separability –1 2 –2 2Logic/ Implementation Errors; Fallibility

2 1 1 –1 2


2 –1 2 1 2 –1 2Des

ign

/Arc

hit

ectu

re

Security technique may:2: mitigate vulnerability (primary)1: mitigate vulnerability (secondary)0: be facilitated by vulnerability

–1: incur vulnerability (secondary)–2: incur vulnerability (primary)

Figure 6.1—Values Relating Vulnerabilities to Security Techniques

When a security technique has the potential to mitigate a vulnerability, the matrixcontains a numeral 2 or 1 at the intersection point. A 2 indicates that the securitytechnique is a primary mitigation candidate, and a 1 indicates that the technique is asecondary mitigation candidate (recall Figure 3.4). Therefore, when one identifies avulnerability, he or she can look across the row and see what security techniquescould be of primary and secondary relevance to that vulnerability by looking fortechniques that have a 2 or 1 (respectively) in its column for the vulnerability row.

For example, in the enlargement in Figure 6.1, an evaluator with a Singularity vul-nerability should first consider Heterogeneity; Redundancy; Decentralization; andVV&A, SW/HW Engineering, Evaluations, Testing to help mitigate the singularity.1

Centralization may be considered as a secondary candidate once the evaluatorconsiders all the primary candidates.

Security Techniques That Incur Vulnerabilities

Interestingly, security techniques can also incur new vulnerabilities when they areimplemented. These cases are noted in the matrix using negative numerals –2 and –1

______________ 1Other techniques are also rated as primary using a 2 but are not visible in the enlargement.


at the intersection point. A –2 indicates a primary caution where the security tech-nique often incurs the vulnerability, and a –1 indicates a secondary caution. There-fore, when one considers any security technique, he or she should look down theentire column for that technique and see what vulnerability cautions can be of pri-mary and secondary relevance to that technique. This identification can be of useregardless of the driving factor for the security technique and can help evaluatorsaudit existing security programs in searching for hidden vulnerabilities.

For example, in the enlargement in Figure 6.1, an evaluator considering the imple-mentation of a Centralization effort (or looking for vulnerabilities that may be pre-sent due to existing centralizations) is given (among other things) a primary caution(–2) that Centrality problems may be introduced.2 The evaluator is also given a sec-ondary caution (–1) that Homogeneity may be introduced, since centralization effortsoften involve standardization of equipment, software, human/social structures, andinfrastructure reliance.

Vulnerability Properties Can Sometimes Facilitate Security Techniques

Finally, in constructing the matrix we noticed instances in which a “vulnerability”might have beneficial side effects that facilitate security techniques. These instancesare noted with the numeral 0 at the intersection point between the vulnerabilityproperty and security technique.

An obvious example is the fact that Centrality facilitates Centralization, since theconcept can be viewed both as a potential vulnerability and a technique for address-ing problems. A less obvious example is when Homogeneity can facilitate both Staticand Dynamic Resource Allocation by providing a uniform set of system componentsthat are more easily interchanged and granted responsibilities. Homogeneity can alsofacilitate Rapid Recovery and Reconstitution since interchangeable parts, commonspares, and reduced logistics allow faster recovery. In a final example, Predictabilitycan be exploited by Deception for ISR techniques to observe how an adversary reactsto predictable situations, yielding clues to their tool set and sophistication.

The matrix does not identify facilitative relationships between security techniques,but they do exist. Recall the examples in Chapter Five of security concepts (e.g.,INFOCONs, I&W, CERTs, firewalls) that rely on the combined effect from differentsecurity techniques (see Figures 5.2, 5.3, 5.4, and 5.5, respectively).

Striking a Balance

The interplay between security techniques that mitigate vulnerabilities and securitytechniques that incur vulnerabilities demonstrates the competing nature of concernsin the security world. Too much of a good thing can be damaging in the securityworld as well. There are usually balances that must be struck

______________ 2Centrality can be both a vulnerability and a positive security technique.


• when weighing the investments in system functionality versus security

• among degrees of implementation of a security technique

• between competing goals and characteristics in security

• among the added costs of implementing a security approach to minimize or pre-vent adding vulnerabilities and the security benefits from the implementation.

For example, in the enlargement in Figure 6.1, an evaluator trying to deal with a Sin-gularity should consider Decentralization (among other things), but decentralizationmay introduce Separability problems (primary concerns), as well as Logic/Implementation Errors and Design Sensitivity/Fragility problems (secondary con-cerns). The evaluator needs to weigh the singularity risks against the costs and risksof decentralization implementation options. Can decentralization be implementedto address the particular type of singularity? Can decentralization be implemented insuch a way to minimize or prevent logic or implementation errors and design sensi-tivities or fragilities? In many cases, the awareness of these cautions can inform theirdesign and implementation of the specific mitigation approaches taken, but theyshould be explicitly considered to balance the overall risk posture of the informationsystem.

Design and Usage Considerations

These relationships do not specify the type of system objects possessing the vulner-abilities, specifics about the object implementation, and the general security posturein the system. Therefore, detailed information about the system under study and theappropriateness of security options must supplement the general knowledgereflected in the matrix. As a result, the matrix forms a guide to aid the evaluatorthrough the huge space of options rather than a predefined prescription. In specificsituations, vulnerabilities may also benefit from the use of security techniques un-valued in the matrix, so at times one may want to reach beyond the techniques calledout in the matrix. New categories arising from security research will need to be addedto the matrix over time.

REFINING THE SECURITY SUGGESTIONS

For each vulnerability property, the methodology matrix displayed in Table 6.1identifies a rather large number of primary and secondary security techniques ofpotential relevance to consider. As the number of vulnerabilities increases, an almostunmanageable set of suggestions is generated. Although the VAM matrix is animprovement over methodologies that do not generate suggestions that help theevaluator reason through the security problem, additional help is needed to refinethe selection process. Also, many of the security suggestions may be generallyappropriate but beyond the purview and authority of the specific evaluator using themethodology, complicating the usability of the raw matrix. Therefore, to focus theevaluator’s attention on the most relevant security techniques, the following filteringapproaches have been developed based on the job role of the evaluator conducting a


security assessment and the distinction of supporting stages in an information sys-tem attack as separate from the core attack (or failure) vulnerability.

Evaluator Job Roles

The first technique for filtering security suggestions utilizes the fact that there aredifferent job roles an evaluator plays; security suggestions can be filtered or elimi-nated if they are not usable by the evaluator because of his or her responsibilities andauthority. The methodology currently employs three evaluator job role categories:operational, development, and policy. Operational evaluators include system users,administrators, and managers who are either responsible for security or have con-cerns about the security of the systems they use. Development evaluators includeresearch, development, testing, and system engineers responsible for creating andconfiguring the information system but are not engaged in its operational use. Policyevaluators specify the overall system needs, requirements, and operating proce-dures—often in the context of the larger use of the information systems. The list ofevaluator types could be expanded or customized in the future, but these three typeshave been useful to date.

The first three rating columns in Table 6.2 and Table 6.3 identify which securitytechniques are strongly or weakly relevant to these three evaluator job roles. Stronglyrelevant security techniques are rated a 2 while weakly relevant security techniquesare rated a 1. For example, Table 6.2 shows that Non-Repudiation, Management, andThreat Response Structures and Plans are strongly relevant (rated 2) to Operationalevaluators (first rating column), since operational individuals and organizations canmonitor users and access, establish and enforce management tools to improvesecurity, and establish procedures and agreements to respond to threats and failures.Control of Exposure, Access, and Output is less relevant (rated 1) because operationalindividuals and organizations can implement and control physical or cyber accessbut can be constrained in the design and implementation of software and proceduresby the designs or policies implemented by others. So, for example, an operationaluser for which the main matrix (Table 6.1) suggests that three possible techniques—(i) Heterogeneity, (ii) Non-Repudiation, and (iii) Control of Exposure, Access, andOutput—may help to mitigate a vulnerability of concern would first consider Non-repudiation, since it rates as strongly relevant (2) in Table 6.2. Control of Exposure,Access, and Output would be considered second since it rates as weakly relevant (1)in Table 6.2. The third matrix suggestion (Heterogeneity) would be considered lastbecause it has no rating in Table 6.2.

It appears that developers have the most flexibility in security choices (i.e., have themost 2s in their rating columns), since they design the architecture, physical plant,and infrastructure dependencies and relationships within the constrains of policiesthat are usually quite broad. However, developers cannot dictate to operational usersexactly how they will use and manage their information systems. Thus, each job typehas its own realm of responsibility, authority, and thus flexibility.


Table 6.2

Resilience and Robustness Techniques for Evaluator Job Roles and Attack Components

RANDMR1601-table6.2

Apply to Physical, Cyber, Human/Social, and Infrastructure

Components

2 1 1 1 2 1

2 1 2

2 1 1 1 1

2 1 1 1 1

2 2

1 2 2 2 2 2

1 2 1 2 2 1

2 2 1 2 2 2 1

2 2

2 2

1 2 2

2 1 2 1

2 2 2 1 2 2 1

2 2 1 2 2 1

1 2 2

1 2 2 2 2

Helps Protect TheseAttack Stages

Usefulto TheseUsers:

Res

ilien

ce/R

obu

stn

ess

Tru

st, A

uth

enti

cati

on

, an

d A

cces

sM

anag

emen

t

Op

erat

ion

al

Po

licy

Kn

ow

led

ge

Acc

ess

Targ

et

No

n-R

etri

buti

on

Ass

ess

Dev

elo

per

General Management

Threat Response Structures and Plans

Control of Exposure, Access, and Output

Trust Learning and Enforcement Systems

Non-Repudiation

Heterogeneity

Redundancy

Centralization

Decentralization

VV&A, SW/HW Engineering, Evaluations, Testing

Hardening

Fault, Uncertainty, Validity, and Quality Tolerance and Graceful Degradation

Static Resource Allocation

Dynamic Resource Allocation

Rapid Reconstitution and Recovery

Adaptability and Learning

2

1

Strongly relevant

Weakly relevant


Table 6.3

ISR, CI, and Deterrence Techniques for Evaluator Job Roles and Attack Components

RANDMR1601-table6.3

2 1 1 1

2 2 1 1 1

2 2 1 1 1

2 2 1 1 1

2 2 2 2 2

2 2 2 2 2

2 2 2 2 2

2 2 2 1

2 2 2 2

2 2 2

2 2 2

2 2 2

Helps Protect These Attack Stages

Inte

l, S

urv

eilla

nce

, & R

eco

nn

aiss

ance

(I

SR

) an

d S

elf-

Aw

aren

ess

Co

un

ter-

Inte

llig

ence

/ D

enia

l of

ISR

&

Targ

et A

cqu

isit

ion

Off

ense

an

d R

etri

buti

on

2

1

Strongly relevant

Weakly relevant

Usefulto TheseUsers:

Apply to Physical, Cyber, Human/Social, and Infrastructure

Components Op

erat

ion

al

Po

licy

Kn

ow

led

ge

Acc

ess

Targ

et

No

n-R

etri

buti

on

Ass

ess

Dev

elo

per

Attack Detection, Recognition, Damage Assessment, and Forensics (Self and Foe)

Intelligence Operations

Self-Awareness, Monitoring, and Assessments

Deception for ISR

General Counter-Intelligence

Unpredictable to Adversary

Deception for CI

Denial of ISR & Target Acquisition

Deterrence

Preventive and Retributive Information / Military Operations

Criminal and Legal Penalties and Guarantees

Law Enforcement; Civil Proceedings

Attack Components

The second technique for filtering security suggestions utilizes the fact that while afailure may have a single vulnerability source, an attack on a system involves distinctcomponents where security techniques can be employed. Knowledge, access, andtarget vulnerabilities are required in any successful attack. Complete prevention ofany one of these three components will deny a successful attack, and protectionsacross these components minimize the overall risk. Two other important attackcomponents—non-retribution and the ability to assess the success of an attack—


while not critical to the success of an attack are so important to many attackers thatan attack can be prevented if these components are denied.

Knowledge includes acquiring and understanding information about the target sys-tem, including general configuration information, security postures and proceduresof the defender, ways to achieve access to the system, knowledge about the targetvulnerability to be exploited, knowledge about the defender’s indications and warn-ing systems, procedures the defender uses to identify the attacker, and informationto support attack assessments.

Access to the attacking system is required to acquire knowledge, perform the actualattack on the target, and assess the success of the attack. Access could be gainedthrough each type of object (physical, cyber, human/social, and infrastructure) andinclude physical access or proximity (e.g., access to restricted areas or electromag-netic access); computer, communication, or control networks; agents with insideaccess; and vital infrastructure systems.

The target vulnerability or vulnerabilities to be exploited in the attack result fromdesign weaknesses and behavioral sensitivities that can be exploited by an attacker.For vulnerabilities arising from natural or accidental causes, the target vulnerabilitycategory is the sole level of concern.

Non-retribution, while not critical to the success of every attack, is often very impor-tant to such attackers as nation-states that do not want their information attacksknown, as well as organizations that worry about reprisals due to their own vulner-abilities.

Finally, complex organizations that rely on information attacks as components inlarger operations need the ability to assess the effectiveness of their attacks (e.g.,when other operations cannot proceed without knowing the success of the attack).

Table 6.4 lists the major ways that an attacker can accomplish each component of anattack (except the target vulnerability itself which is often a property of the informa-tion system itself and not under the purview of the attacker). These methods are dis-tributed across the four major system objects (physical, cyber, human/social, andinfrastructure). Table 6.5 identifies which vulnerability properties can be exploited ineach of the five attack components.

Attack Stage Relevance by Evaluator Job Role

Taken together, evaluator role and attack stage filtering yields the following emergenteffect that helps refine security suggestions. These filters focus attention on attackcomponents in which the evaluator has more ability to implement protections andcountermeasures. Thus, operational users generally have greater control over,knowledge of, and access to the systems than over their architecture and implemen-tations. Developers can adjust the hardware and software to minimize vulnerabilitiesin the architecture and implementations but have less influence over use, knowl-edge, and access. Finally, policymakers set general guidance and constraints indesign and operation but do not specify actual implementation details.


Table 6.4

Methods for Accomplishing Each Component of an Attack

RANDMR1601-table6.4


Attack Stage

Hardware (Data Storage, Input/Output, Clients, Servers), Network and

Communications, Locality

Software, Data, Information, Knowledge

Staff, Command, Management, Policies, Procedures, Training,

Authentication

Ship, Building, Power, Water, Air, Environment

Knowledge

Access

Non-Retribution

Assess


Viewable, blueprints, standard architecture, purchase orders, deductable from behavior or first principles (e.g., physics); hacker bulletin boards; chat rooms; Nmap port scan, open source information (e.g., Web); source code; reverse engineering; virus/worm reports; hacker bulletin boards; chat rooms; behavior of the system; blue prints; standard architectures; sniffers; Org. charts; “social engineering”; HUMINT

Insider; visitors; neighborhood; networks; EW; phone; email; physical presence; agents; signals

Agents; disguises; camouflage; spoofing; zombies; agents; voice/communication disguises; camouflage

Viewable, deductable from behavior or first principles (e.g., physics); insider; visitors; neighborhood; Nmap port scan, open source information (e.g., Web); news; virus/worm reports; hacker bulletin boards; chat rooms; behavior of the system; sniffers; networks; “social engineering”; HUMINT; phone; email; physical presence; agents; signals

Org. charts; “social engineering”; HUMINT

Phone; email; physical presence; agents; signals

Agents; voice/communication disguises; camouflage

“Social engineering”; HUMINT;phone; email; physical presence; agents; signals

Nmap port scan, open source information (e.g., Web); source code; reverse engineering; virus/worm reports; hacker bulletin boards; chat rooms; behavior of the system; blue prints; standard architectures; sniffers

Networks; EW

Spoofing; zombies

Nmap port scan, open source information (e.g., Web); news; virus/worm reports; hacker bulletin boards; chat rooms; behavior of the system; sniffers; networks

Viewable, blueprints, standard architecture, purchase orders, deductable from behavior or first principles (e.g., physics); hacker bulletin boards; chat rooms

Insider; visitors; neighborhood

Agents; disguises; camouflage

Viewable, deductable from behavioror first principles (e.g., physics); insider; visitors; neighborhood

58F

ind

ing an

d F

ixing V

uln

erabilities in

Info

rmatio

n System

s: VA

M M

etho

do

logy


EXAMPLE SECURITY OPTIONS ARISING FROM THE USE OFTHE METHODOLOGY

The following shows the kind of security options that an evaluator from an opera-tional organization can generate, using the methodology as an analytical guide toaddressing security concerns. These examples involve the common security concernspresented in Chapter Four in the checklist matrix example (see Table 4.3). Theseconcerns range across cyber, physical, and human/social object of informationsystems for a number of different vulnerability attributes. The analysis in theexamples is far from comprehensive, but it illustrates the use of the VAM methodol-ogy on well-known problems in the information security field and the types of spe-cific security strategies that may come out of the analysis. Some security ideas arecommonly known, while others are novel.

These generic examples do not contain specifics related to an actual vulnerability ormore-specific examples of security techniques that address the vulnerabilities’unique characteristics. Nevertheless, they help to demonstrate how the methodologyguides the evaluator to security techniques, and the kind of instantiations of thetechniques that may be considered.

For each example, we specify the vulnerability attribute and object type followed by ashort description of the vulnerability. We then highlight a number of security tech-nique categories suggested by the matrix, along with specific mitigation strategieswithin the categories that may be appropriate for the particular vulnerability inquestion. These specific mitigation strategies arise both from the general list ofsecurity technique examples described in Chapter Five and from the novel counter-measures that came to us when we considered the security technique categoryafresh.

Insider Threat

Vulnerability Attribute: Malevolence.

Type of Target: Human/social.

It is widely believed that the “insider threat” (malevolent behavior by a trusted per-son with approved access to a critical information system) is the greatest threat to thesecurity of information systems. The “insider” might be someone with a grudge, orsomeone co-opted by an enemy through blackmail, bribes, or the like.

Potential Relevant Mitigation Strategies:

Control of exposure, access, and output. Ensure that “insiders” have only that accesswithin the network and physical areas needed for their jobs.

Non-repudiation. Maintain access and permissions audit logs to allow prosecution ofanyone violating authorized procedures.


Table 6.5

Vulnerability Exploitation by Attack Component

RANDMR1601-table6.5

1 1 1

1 1 1

2 2 2

1 1 1

1 2

2 1

2

2

1 1 2

1 2 1

2

2

2

1

2

1

Strongly relevant

Weakly relevant

Ass

ess

Kn

ow

led

ge

Acc

ess

Targ

et

No

n-R

etri

buti

on

Attributes

Used by Attacker for

Used by Attacker for

Attributes Ass

ess

Kn

ow

led

ge

Acc

ess

Targ

et

No

n-R

etri

buti

on

Des

ign

/Arc

hit

ectu

re

Gen

eral

Beh

avio

r

Singularity

Uniqueness

Centrality

Homogeneity

Separability

Logic/ Implementation Errors; Fallibility

Design Sensitivity/ Fragility/Limits/ Finiteness

Unrecoverability

Behavioral Sensitivity /Fragility

Malevolence

Rigidity

Malleability

Gullibility/ Deceivability/Naiveté

Complacency

Corruptibility/ Controllability

Accessible/ Detectable/ Identifiable/ Transparent/ Interceptable



Predictability

2

2

2

2

2

2

2

2


General management. Ensure that procedures are in place (e.g., security campaignsand reminders) to alert staff of the dangers of insider threats (including their ownunwitting recruitment) and other threats to critical information systems.

Self-awareness, monitoring, and assessments. (See “Attack detection . . . ” below. Con-sider especially the use of intrusion detection software within the local area networks[LANs].)

Deception for intelligence, surveillance, and reconnaissance. Create “honeypots” (e.g.,files containing bogus but attractive information) within critical systems so thataccessing these honeypots will generate an alert stating that an individual is engag-ing in suspicious behavior and should be monitored.

Attack detection, recognition, damage assessment, and forensics (self and foe). Con-sider the use of real-time “intrusion detection” software to detect abnormal behaviorthat violates a set of preprogrammed rules or exhibits statistical abnormalities.Review access and audit logs for suspicious behavior.

Unpredictable to adversary. Limit knowledge of system configurations, key compo-nent locations, and key system dependencies—even within “trusted” staff.

Deterrence. Use criminal and legal penalties (see below) against offenders to deterothers.

Criminal and legal penalties and guarantees. Ensure that criminal and legal penaltiesfor insider attacks are well developed, used when appropriate, and thus act as adeterrence.

Law enforcement, civil proceedings. Use law enforcement to punish illegal behavioras a deterrence.

Inability to Handle Distributed Denial-of-Service Attacks

Vulnerability Attribute: Behavioral sensitivity/fragility.


One of the most difficult kinds of cyber attack to handle is a DDoS attack, whereinhundreds or thousands of different computers bombard a specific network router orother component with packets or requests for service—usually ones with erroneousinformation that require additional time for processing. Information networks mustbe especially configured and designed if they are to thwart (to the extent possible)this kind of attack that depends on behavioral characteristics and sensitivities of thenetwork(s).


Decentralization. Consider using parallel or backup servers that can take over whenthe primary server is incapacitated due to a DDoS attack. Use rotating serverresponsibilities to present an unpredictable moving target to the DDoS attacker.


VV&A, software/hardware engineering, evaluations, testing. Test the network (e.g.,through “red teaming” and other means) for robustness against DDoS attacks.

Control of exposure, access, and output. Establish control points at various positionsin the network where filters can be installed for DDoS traffic.

Fault, uncertainty, validity, and quality tolerance and graceful degradation. Considermeans to allow graceful degradation of the networks under DDoS attack (e.g., byreducing all other IP traffic from other applications).

Dynamic resource allocation. Provide a rapid way to cut off DDoS traffic further upthe network chain (e.g., at the gateway to your Internet service provider).

Self-awareness, monitoring, and assessments. Provide monitoring for early warning ofDDoS attacks at all levels of gateways within critical IP networks; have preplannedprocedures in place for reaction when such monitoring detects a DDoS attack.

IP Spoofing

Vulnerability Attribute: Gullibility/deceivability/naiveté.


To “spoof” an IP address, within a packet or message, means to substitute an erro-neous address in the place where a valid one should appear. By this means, itbecomes difficult to ascertain the true sender of an information packet or session,and therefore difficult to permit various forms of attack that disguise their source.


Hardening; also control of exposure, access, and output. Consider enforcing variousfirewall precautions and rules—for example, disallowing any IP packets to be emittedfrom a local network with source IP addresses not valid for that network.

Threat response structures and plans. When any host (computer) in the systemdetermines that invalid IP addresses are being used by some sender, a preplannedresponse can be initiated to alert other hosts to block transmissions from theaddresses.

Adaptability and learning. Firewalls, routers, and other devices operating key IP net-works may be adaptable so that responses to known IP-spoofing attacks can bequickly instituted throughout the network.

Vaccination. (See “Threat response structures and plans” above.) As soon as a bogusIP address is discovered, other hosts and routers in the network could be“vaccinated” against it, as a rudimentary form of “immunological defense system.”

Self-awareness, monitoring, and assessments. Firewalls, routers, and similar devicesmust constantly be alert to bogus IP addresses so that remedial steps such as thoseabove can be taken.


Inability to Detect Changes to IP Net, Making IP Masking Possible

Vulnerability Attribute: Self-unawareness and unpredictability.


If an IP network does not have active monitoring programs and tools to allow per-sonnel to ascertain whether a new host (IP address) has been inserted, or removed,from the net, then it could be possible for someone to insert an unauthorized laptopor another device onto a network connection and download information into thatdevice. This danger is especially prevalent for wireless networks, where the“connection” can be from a location away from visible network ports or even outsidethe organization’s building. This is a lack of “self-awareness” of the network configu-ration, and changes to it, during its operation.


Centralization. Institute a central, real-time network monitoring activity, with sen-sors and application programs capable of detecting and displaying any changes tothe network configuration.

Self-awareness, monitoring, and assessments. Through appropriate monitoring toolsand techniques, the network should be aware of any changes to its configuration,and highlight those—at the time they occur—in a display or signal to network opera-tors.

Centralized Network Operations Centers

Vulnerability Attribute: Centrality.


Network operations centers can contain many vital physical components (e.g., keyequipment and backups) in one central location. As such, a physical attack coulddisable not only primary, but also backup, routers and key communications equip-ment.


Decentralization. Consider providing multiple support centers. Do not store backupequipment in the same physical location as main equipment. Provide multipleaccess points where routers can be placed on the physical LAN cables.

Control of exposure, access, and output. Restrict physical access to the room based onneed-to-use. Provide protective shielding or structure (physical and electrical) tohelp prevent accidental or deliberate changes, damage, etc. Put tamper-resistanttabs on the panel and/or shielding. Keep backup equipment off-line to provide pro-tection until needed.

Hardening. Provide protective shielding or structure (physical and electrical) to helpprevent accidental or deliberate changes, damage, etc. Put tamper-resistant tabs on


the panel and/or shielding. Keep backup equipment off-line to provide protectionuntil needed.

Threat response structures and plans. Have preplanned procedures for recovery toany centralized components.

Rapid reconstitution and recovery. Generate plans on how to manually rebuildcapability for vital communications. Develop replacement contingencies. Examinelocal ability to repair systems. Store backup equipment and configuration informa-tion in a different location that is not likely to be destroyed in the same physicalattack.

Common Commercial Software and Hardware Are Well Knownand Predictable

Vulnerability Attribute: Predictability.

Type of Target: Physical and Cyber.

The personal computers, workstations, routers, servers, and other components ofcritical information systems are often heavily based on commercial products, such asCisco router software; Windows NT; Microsoft Outlook, Word, Excel, PowerPoint,etc. As such, the vulnerabilities, organization, and, in some cases, source code ofsuch programs are widely known. These programs are thus highly predictable in thatother copies of them can be tested to find situations (e.g., exceeding the capacity of adatabase) in which their performance fails.


Heterogeneity. Consider using a variety of COTS software and hardware—for exam-ple, Netscape in addition to Internet Explorer; Netscape mail in addition to MicrosoftOutlook. Then a virus or worm capitalizing on a well-known flaw may not infect allsystems at the same time.

VV&A, software/hardware engineering, evaluations, testing. To the extent possible,test heavily used commercial hardware and software in critical information systemsfor vulnerabilities. Use “red team” approaches to system testing. Use “open source”code for critical operating systems and applications that can be inspected for buriedflaws. (Note that the many users in the open-source community already search forsuch flaws and use of seasoned open-source code inherits the benefits of theirlabors.)

Management. Ensure that any available patches and fixes are tested and installedrapidly as soon as they become available.

Immunological defense systems. Establish protocols to rapidly share information onan attack’s reliance on standard commercial-system vulnerabilities and configura-tions.


Deception for counterintelligence. Provide deceptive files (e.g., WIN file types onUNIX and Macintosh equipment and software) to make it harder to determine thetype of software being used, especially via automatic scanning programs. Place sys-tem files in unorthodox places or store them under different names (e.g., do not storeUNIX binaries under /bin; do not store system files under “C:WINNT” or “C:ProgramFiles”; change the default folder name for email attachments).

Unpredictable to adversary. Remove information about the type of software usedfrom both internally and externally accessible systems when possible.

Standardized Software

Vulnerability Attribute: Homogeneity.


The heavy use of standardized software for routers (e.g., Cisco operating system),servers (e.g., Windows NT), and PCs/workstations (e.g., Windows NT or MacintoshOS) creates a very homogeneous information and communication system. Any flawin one of these designs can be replicated widely within the information system andtherefore can provide a common vulnerability across the system.


Heterogeneity. Consider deliberate use of alternative software (e.g., Linux, MacintoshOS, Sun Solaris) as part of the network or desktop configuration so that if any virus,worm, or other cyberattack “takes down” all standard systems (e.g., Windows NTrunning Outlook), then these other systems may continue operating and provideemergency service until the damage is contained, isolated, and removed.

VV&A, software/hardware engineering, evaluations, testing. To the extent that stan-dardized (homogeneous) system components are widely used throughout criticalsystems, use extra testing to ensure they are free of exploitable flaws to the extentpossible.

Hardening. Dependence on standardized software should trigger extra measures toensure that it is “hardened” against attack—for example, by retaining backup copiesof critical operating systems and applications in a “hard” (unmodifiable) medium,such as CD-ROM or DVD-R, for use in recovering systems after an attack.

Fault, uncertainty, validity, and quality tolerance and graceful degradation. Ensurethat standardized software is “fault tolerant” and degrades gracefully under varioustypes of attacks. For example, software might shed noncritical applications when anattack is sensed and shut various firewall options to help thwart a cyberattack.

Weaknesses in Router or Desktop Applications Software

Vulnerability Attribute: Logic/implementation errors; fallibility.



Fundamental design or implementation flaws in standard software used in operatingsystems (workstation and router) and desktop applications may exist. These flaws, ifthey become known to an attacker, could provide unauthorized access or destruc-tion.


Heterogeneity. Use a diverse set of servers based on differing software (such as emailprograms) and operating systems (e.g., UNIX in addition to Windows NT), especiallyon systems with higher security standards.

VV&A, software/hardware engineering, evaluations, testing. Conduct thorough “redteaming” and testing of COTS products to understand inherent vulnerabilities;develop security procedures to mitigate vulnerabilities. Ensure proper firewall instal-lations and maintenance at boundaries as well as locally (when feasible). Keep up todate on patches and fixes as they become available.

Control of exposure, access, and output. Restrict physical access to key equipmentbased on need-to-use, helping to prevent insider or intruder cyber attacks and acci-dents.

General management. Ensure that all procedures to protect “root” access are imple-mented and kept up to date.

Immunological defense systems. Adopt “immunological” defensive measures, inwhich one system, detecting an attack or flaw, notifies other similar systems toincrease their defenses against such an attack or flaw.

Vaccination. Have a central location automatically “vaccinate” systemwide compo-nents and computers with patches and fixes as soon as they become tested andavailable. Be careful that this centralized updating procedure is well protected toprevent an easy target for spreading attacks across the information system and thatpatches and fixes are well tested.

Electronic Environmental Tolerances

Vulnerability Attribute: Design sensitivity/fragility/limits/finiteness.


Various commercial electronic equipment vital to network communications andcomputing are often not hardened for environmental influences (e.g., temperature,smoke, humidity) or extreme attack means (e.g., EMPs).


Heterogeneity. Consider using equipment with differing ranges of environmental tol-erances, so entire capabilities would not be lost under certain extreme environmen-tal conditions.


Redundancy. Store backup equipment in sealed containers, perhaps with EMP-shielding. Provide local, redundant environmental conditioning equipment for sin-gular, centralized equipment rooms.

VV&A, software/hardware engineering, evaluations, testing. Test and make availablethe environmental ranges within which key electronic equipment can operate;attempt to procure equipment with the least environmental sensitivity.

Control of exposure, access, and output. Install positive pressure air conditioning tokeep smoke, humidity, or other environmental hazards from entering electronicenvironments—especially those with singularities. Install EMP shielding for criticalequipment and for a subset of terminals that can be used for minimal capabilityunder adverse conditions.

Hardening. (See “Install EMP shielding . . . ” and “Store backup equipment in sealedcontainers . . . ” above.)

Self-awareness, monitoring, and assessments. Install sensors for all adverse environ-mental conditions that could affect electronic equipment, especially those that aresingular or centralized. Have prearranged contingency plans for when environmen-tal conditions exceed those under which the equipment can operate.

69

Chapter Seven

AUTOMATING AND EXECUTING THE METHODOLOGY:A SPREADSHEET TOOL

Manually working through the evolved methodology’s large matrix, evaluator filters,and attack-component filters is laborious for an evaluator and may prevent thoroughor careful application of the VAM methodology. Moreover, looking up the definitionsof the various vulnerabilities, security techniques, and attack methods during thecourse of an evaluation can be daunting as well. Therefore, a prototype computer-ized tool has been developed and implemented to assist in using the methodology.This tool is implemented as a Microsoft Excel spreadsheet using Visual Basic algo-rithms to perform information lookups as well as simple scoring of vulnerability risksbased on the inputs from the evaluator.1

Even with this tool, it is important to realize that comprehensive vulnerabilityassessments cannot be fully automated. Automated network and computer scanningsoftware and methodologies can identify specific, known vulnerabilities such as backdoors, open ports, missing patches, throughput limitations, operating anomalies,and the like. However, automated tools cannot conduct a top-down review ofproperties that have yet to be exploited or which involve the full range of physical,human/social, and infrastructure configurations and behaviors. Their fidelitydepends greatly on the breadth of their threat or operating models, the inputs theygenerate, and the outputs they observe. Comprehensive reviews often require thedeep knowledge and experience of people intimately involved in the informationsystem and its operations. Our methodology is an aid to evaluators, yet theautomated tool helps the evaluator deal with the large amount of information in themethodology.

INITIAL STEPS PERFORMED MANUALLY

Steps 1 and 2 of the methodology (identifying the critical information functions andidentifying the critical information systems supporting these functions) are executedmanually through evaluator assessments and reviews of the information system inquestion. Although complex in their own right, these two steps often require

______________ 1Nothing inherent about Excel’s functionality was required to implement the prototype tool. It was chosensimply as a convenient and commonly available spreadsheet application in which the required algorithmscould be implemented. A Web-based tool might be another useful platform for implementing the tool,given its ease of access and availability (see Chapter Eight).


organizational investigations and considerations of those that are hard to structureand facilitate with a small tool. Such processes as OCTAVE (Alberts et al., 1999, 2001)have forms and procedures that can be considered for these steps, and the CommonCriteria (ISO 15408) specifies a breadth of issues and considerations that should beaddressed by selected processes.

VULNERABILITIES GUIDED BY AND RECORDED ON A FORM

For step 3, a worksheet form is available in the VAM tool (see Table 4.2). Thisworksheet should be completed for each information system (or major subsystem)under review and at various architectural levels within the system. This formfacilitates the execution of step 3 of the methodology (identifying the vulnerabilitiesin the critical systems) by providing the evaluator with the full list of vulnerabilityproperties in the rows and listing the four different object types in an informationsystem (physical, cyber, human/social, and infrastructure) as columns. Using thisform helps to ensure a broad review of target vulnerabilities across all thesedimensions rather than a simple recording of the standard types of vulnerabilitiesthat come to mind or those that are commonly raised in the evaluator’s organization.

Remember also that the vulnerability to security technique matrix identifies cautionswhen security techniques may incur vulnerabilities. The evaluator may find it usefulto work through that matrix (either manually in Table 6.1 or using the Excel tooldescribed below) to see what vulnerabilities may already be present in the system asa result of the security techniques employed.

THE RISK ASSESSMENT AND MITIGATION SELECTION SPREADSHEET

After performing the first three steps, the methodology’s complexity increasesgreatly. The vulnerability assessment and mitigation selection spreadsheet shown inFigure 7.1 reduces this complexity by providing automated lookups and calculationsbased on both the methodology and the information supplied by the evaluator.

Specifying the User Type and Vulnerability to Be Analyzed

First, the evaluator sets up the basic information for the vulnerability as shown inFigure 7.2. The evaluator’s job role is provided at part 1, specifying which evaluatorrole filter to employ in the analysis on the form. A free text box is included at part 2 toallow the user to describe the vulnerability under study (i.e., copying andembellishing the description noted on the vulnerability form). Parts 3 and 4 specifythe type of vulnerability property and type of object under question as pull-downmenus.


RANDMR1601-7.1

User (select): Target Vulnerability Attribute Type (select): Target Object Type (select):

Description and examples:Single point-of-failure

Target Vulnerability (fill in):1 2 3

Singularity

4


Physical

Attack Thread: Risk (select): Mitigation Suggestions to Consider: Selected Mitigations (fill in): Cost, Difficulty, Purview (select):

Risks After Mitigation (select):


Notes (fill in): Attack Thread:6 7 9PrimarySecondary

10 11

8

(select option level):

Knowledge

Access

Target

Non-Retribution

Assess

Negligible

Negligible

Negligible

Negligible

Negligible

N/A

N/A

N/A

N/A

N/A

Rating Score Rating Score

Negligible 0 Negligible 0 MinimalistsNegligible 0 Negligible 0 Nation StatesNegligible 0 Negligible 0 MinimalistsNegligible 0 Negligible 0 Nation States

Unmitigated: Mitigated:

General Counterintelligence; Unpredictable to Adversary; Deception for CI; Denial of ISR & Target Acquisition

Non-Repudiation; General Management; Threat Response Structures and Plans; Vaccination


Non-Repudiation; General Counterintelligence; Unpredictable to Adversary; Deception for CI; Deterrence; Preventive and Retributive Information/Military Operations

General Counter-Intelligence; Unpredictable to Adversary; Deception for CI

Negligible

Negligible

Negligible

Negligible

Negligible

Knowledge

Access

Target

Retribution

Assess

Score: Rating Score

(min 1st 3) Negligible 0

(min all) Negligible 0

min(target, sum 1st 3) Negligible 0

min(target,sum all) Negligible 0

Generic Vulnerabilities for a'Physical' Target at Selected Attack Step:

Minimalists

Minimalists

Nation States

Nation States

Unmitigated

5

Knowledge(select attack step):

Viewable, blueprints, standard architecture, purchase orders, deductable from behavior or first principles (e.g., physics); hacker bulletin boards; chat rooms;

Examples for a 'Physical' Target for Selected Mitigation:Threat Response Structures and Plans

(select mitigation):

Secondary:Cautions for Selected Mitigation:

Primary:* Centrality; * Homogeneity; * Logic/Implementation Errors; Fallibility; * Design Sensitivity/Fragility/Limits/Finiteness; * Behavioral Sensitivity/Fragility; * Complacency; * Accessible/Detectable/Identifiable/Transparent/ Interceptable; * Self Unawareness and Unpredictability; * Predictability

* Separability; * Rigidity; * Gullibility/Deceivability/Naiveté

Examples: INFOCONs, MOUs. Hierarchy of increasing information attack threat levels and concomitant protective measures to be taken. Examples include: INFOCONs and other preplanned static and dynamic protective measures. Specific actions include: configuration protection and backup; establishment of backup servers; infrastructure backup; security plans and MOUs; purging and filtering; adaptive response to adaptive attacks; resource reallocation.

Non-

Vulnerability Attack Rating Form

Figure 7.1—The VAM Methodology Spreadsheet Tool

Au

tom

ating an

d E

xecutin

g the M

etho

do

logy: A

Spread

sheet T

oo

l71


RANDMR1601-7.2

User (select): Target Vulnerability Attribute Type (select): Target Object Type (select):

Description and examples:Single point-of-failure

Target Vulnerability (fill in):1 2 3

Singularity

4


Physical

Attack Thread: Risk (select): Mitigation Suggestions to Consider: Selected Mitigations (fill in):


Notes (fill in):6 7 9PrimarySecondary

8

(select option level):

General Counterintelligence; Unpredictable to Adversary; Deception for CI; Denial of ISR & Target Acquisition

Non-Repudiation; General Management; Threat Response Structures and Plans; Vaccination


Non-Repudiation; General Counterintelligence; Unpredictable to Adversary; Deception for CI; Deterrence; Preventive and Retributive Information/Military Operations

General Counter-Intelligence; Unpredictable to Adversary; Deception for CI

Negligible

Negligible

Negligible

Negligible

Negligible

Knowledge

Access

Target

Retribution

Assess

Score: Rating Score

(min 1st 3) Negligible 0

(min all) Negligible 0

min(target, sum 1st 3) Negligible 0

min(target,sum all) Negligible 0

Generic Vulnerabilities for a'Physical' Target at Selected Attack Step:

Minimalists

Minimalists

Nation States

Nation States

Unmitigated

5

Knowledge(select attack step):

Viewable, blueprints, standard architecture, purchase orders, deductable from behavior or first principles (e.g., physics); hacker bulletin boards; chat rooms;

Examples for a 'Physical' Target for Selected Mitigation:Threat Response Structures and Plans

(select mitigation):

Secondary:Cautions for Selected Mitigation:

Primary:* Centrality; * Homogeneity; * Logic/Implementation Errors; Fallibility; * Design Sensitivity/Fragility/Limits/Finiteness; * Behavioral Sensitivity/Fragility; * Complacency; * Accessible/Detectable/Identifiable/Transparent/ Interceptable; * Self Unawareness and Unpredictability; * Predictability

* Separability; * Rigidity; * Gullibility/Deceivability/Naiveté

Examples: INFOCONs, MOUs. Hierarchy of increasing information attack threat levels and concomitant protective measures to be taken. Examples include: INFOCONs and other preplanned static and dynamic protective measures. Specific actions include: configuration protection and backup; establishment of backup servers; infrastructure backup; security plans and MOUs; purging and filtering; adaptive response to adaptive attacks; resource reallocation.

Non-

Vulnerability Attack Rating Form1 2 3 4

Evaluator type Our main vulnerability Property Object type

Figure 7.2—Specifying the User Type and Vulnerability to Be Analyzed

72F

ind

ing an

d F

ixing V

uln

erabilities in

Info

rmatio

n System

s: VA

M M

etho

do

logy

Automating and Executing the Methodology: A Spreadsheet Tool 73

Evaluating the Risks for Each Attack Component

Second, the evaluator needs to evaluate the risks of the system vulnerability for thefive attack components—knowledge, access, target vulnerability, non-retribution,and assess—by completing steps 5 through 7, shown in Figure 7.3. Nondeliberatefailures can be assessed by completing only the target vulnerability row with thevulnerability that leads to the failure of concern.

Part 5 allows the evaluator to review the basic ways an adversary may achieve thefour supporting attack components (knowledge, access, non-retribution, and assess)that support the target vulnerability assessed earlier in step 3. Here the evaluator canselect an attack component in the pull-down menu and view the methods fromTable 6.4 based on the object type specified in part 4.

Figure 7.3—Evaluating the Risks for Each Attack Component


Based on prior reviews and part 5, the evaluator rates in step 6 the risks for each ofthe five attack components using pull-down menus. The risks are rated as eithernegligible, low, moderate, or high.

Based on these ratings, the system performs four simple calculations to provide acombined risk rating and score. The risk rating gives a simple negligible, low,moderate, or high value for all five components together, while the score is a numericvalue between 0 and 10. The tool uses four simple algorithms to combine the riskratings.

The first algorithm, labeled “min 1st 3,” uses the minimum rating from the key threeattack components (knowledge, access, and target vulnerability) that are essential toany IO/IW attack. This algorithm takes the philosophy of rating the “weakest link” ofthe essential components and is most relevant to mitigation strategies that try toprevent an attack by denying the adversary a key link in the attack (e.g., when dealingwith minimalist attackers who do not worry as much about non-retribution orassessing the success of their attack).

The second algorithm, labeled “min all,” also uses the “weakest link” philosophy butprovides the minimum rating from all five attack components. Thus, this value ismost relevant in situations in which the adversary is concerned with all fivecomponents equally (e.g., nation-states) and in which the security approach is todeny the attacker all these links.

The third algorithm, labeled “min(target, sum 1st 3),” calculates a combined rating ofthe three key components but chooses the target rating if it is less than thatcombined sum. This algorithm is useful when the evaluator, in dealing withminimalist attackers, wants to combine the values of the key components but alsorecognizes that the target vulnerability is essential (i.e., if there is a very low risk tothe target vulnerability, no amount of knowledge or access will improve the ultimateattackability of the target).

Finally the fourth algorithm, labeled “min(target, sum all),” combines all five attackcomponents (i.e., for nation-state attacks) but also recognizes that the targetvulnerability has to be there for an attack.

Other algorithms could, of course, be developed to combine the evaluator-suppliedrisk ratings, but these four serve as reasonable starting points in trying to provide anoverall rating for the vulnerability in question. The use of the “min” function reflectsthe importance of each component to an information attack (sometimes reflected inthe saying that “IO is a three-legged stool”), and the resulting important securityobservation that even though a user may not be able to address a vulnerability in onearea (say, the target vulnerability from a computer design), techniques applied inother areas (say, denying access or knowledge) can have a significant positive effectin securing a system. The “sum” function can also be useful in combining mitigationeffects across the attack components, especially when complete risk mitigation is notpossible in a key area.


Additional use of these score-combination algorithms is needed to understand theirutility and validity under different types of attack weightings and approaches fordifferent adversary types. Given the subjective nature of the ratings, more-complicated algorithms may be meaningless and merely make it harder tounderstand the underlying risks. Under certain circumstances, it may be beneficialmerely to compare the pre- and post-mitigated ratings input by the user, forgoingthe scoring mechanism.

Tool users will note that the system provides colorings to the ratings (clear, yellow,orange, and red, respectively) to improve the ability to skim the ratings on thespreadsheet and quickly determine how a given vulnerability rates (especially incomparison to ratings for other vulnerabilities on separate worksheets), howeffective the mitigation strategies are anticipated to be, and what attack componentswill receive the mitigation focus.

Considering and Selecting Mitigations

Third, the evaluator uses the tool to review and select mitigation strategies across theattack component areas. Figure 7.4 shows the part of the spreadsheet that automatesthe matrix lookup, matching relevant security techniques to vulnerabilities for eachattack component given the evaluator’s role.

Figure 7.4—Considering and Selecting Mitigations


Part 8 allows the evaluator to review the mitigation recommendations for each of theattack components. The primary or secondary recommendations from the matrix areshown based on the evaluator’s selection in the list menu. Relevant techniques areshown in the five attack category rows. Examples and explanations of what thesetechniques entail can be viewed by selecting the technique in the pull-down menubelow the suggestion list. The tool also looks up the primary and secondary cautionsin the matrix for the indicated security technique.

Using this information, the evaluator selects the best mitigation approaches for hisor her particular situation, taking into account the cautions, the risk profile acrossthe attack components, the available techniques across that profile, the implemen-tation issues (cost, availability, purview, etc.), and the potential benefits. Part 9 pro-vides free text space for the evaluator to record the security techniques he or sheplans to implement.

Rating Costs and the Mitigated Risks

Now that the evaluator has selected the security techniques for further considerationand implementation, the tool allows the evaluator to record his or her rating of thecost, difficulty, and purview for each attack component’s mitigation set under part 10in Figure 7.5.

Figure 7.5—Rating Costs and the Mitigated Risks


This figure also shows part 11, where the evaluator can estimate what the risksshould be for each component of the attack after the selected security techniques areimplemented. The mitigated risk estimates use the same format as the unmitigatedrisk rating scheme, employing pull-down menus and four rating values (negligible,low, moderate, or high). The tool uses the same algorithms to produce combined riskratings and scores, and shows again the unmitigated ratings and scores next to thenew ones for comparison.

In addition to helping the evaluator work through estimates and decide whichsecurity techniques to pursue, the cost, applicability, and risk ratings help to recordthese assessments for future review. They provide a visual representation of theevaluator’s expert assessments both when reviewing the security techniques underconsideration for all the vulnerabilities across each worksheet completed and toprovide descriptions and overviews to managers and customers for approval andfunding decisions.

The evaluator can also use parts 10 and 11 in the worksheet to record the results ofapplying and testing the security techniques to the actual system (steps 5 and 6 of themethodology). These results are much more definitive than the evaluator’s estimatesduring step 4 and are important to record both to reassess what additionalprocedures should be taken to mitigate the identified (i.e., a repeat of steps 4–6) andfor future reference in rating the effect of security techniques in reducing risks.

79

Chapter Eight

NEXT STEPS AND DISCUSSION

Here we present some deficiencies in the current VAM methodology, possible nextsteps, and some general discussion about the methodology, its use, and the utility ofsecurity assessments.

FUTURE CHALLENGES AND OPPORTUNITIES

While the VAM methodology advances the techniques available for assessing andmitigating information system vulnerabilities, the entire six-step methodology wouldbenefit from additional automation development and support aids.

Guiding the Evaluation of Critical Functions and Systems

Applying the strategy-to-tasks technique to reviewing the critical information func-tions and their supporting systems (steps 1 and 2) may benefit from specific guid-ance and worksheets in the tool to help the evaluator explore what is most criticaland to help prompt an objective review that avoids standard concerns and prede-fined notions. These steps focus on the essential information functions and the sys-tems essential for supporting the functions, but additional thought or structure maybe helpful for addressing and relating the so-called valuable functions and systems,as well as the essential functions and systems.

Additional Guidance and Automation:Spreadsheet and Web-Based Implementations

While the current spreadsheet tool greatly assists in exercising the methodology(especially steps 3 and 4), the use of a Web-based implementation could offer anumber of significant advantages. A Web-based version could be structured around aquestion-and-answer format, in which the system helps walk the evaluator throughthe entire process. The system could also help the evaluator deal with the complexityof multiple vulnerabilities by automatically filling in subordinate forms with priordata and settings. An online database could also facilitate the storage and preserva-tion of the assessment findings and eliminate the need to duplicate worksheet formsfor multiple vulnerability assessments. Nevertheless, the spreadsheet version hasproven very useful in our early application of the methodology to Naval systems, and


we anticipate receiving feedback from additional users who have shown interest inusing the methodology.

Prioritizing Security Options

The method of deciding what security techniques to employ and how well they coverthe vulnerability space can also benefit from additional operational mathematics. Anunpublished approach developed by Richard Hillestad and colleagues at RAND hasbeen used as a complement to the VAM methodology in reviewing RAND’s ownorganizational vulnerabilities, generating security options, and prioritizing theseoptions given fiscal constraints and the organization’s risk tolerance. We anticipatethat this integer programming-based approach will be useful to other organizationsand will serve an important complementary role with the VAM methodology.

Quantitative Assessments of Threats, Risks, and Mitigations

Quantitative assessments and valuations of threats, risks, and mitigations remain achallenge. The simple assessments currently used in the methodology rely on thesubjective expertise of the evaluator and do not provide an independent way to gen-erate quantitative (or even qualitative) values. This problem is exacerbated in theareas where the VAM methodology shines: when the threats are theoretical and whenvulnerabilities have yet to be exploited by adversaries. If there is no history of attacks,then it is hard to

• estimate a probability that the vulnerability will be exploited,

• perform a cost-benefit analysis for security investments against that threat, or

• conduct tradeoff analysis between various theoretical threats and vulnerabilities.

This problem was poignantly demonstrated in the difficulties of justifying counter-terrorism funding before the attacks of September 11, 2001, and in calculating theprobability and severity of anthrax attacks before the anthrax mailings in 2002.However, September 11 and the anthrax mailings demonstrated the importance offinding and mitigating previously unexploited vulnerabilities and continuing to lookfor the next vulnerability that an adversary may turn to once one addresses apreviously exploited vulnerability. We need to be proactive in addition to reactive.

Integrating VAM Functions into Other Assessment Methodologies

Given that many security assessment methodologies share very similar steps with theVAM methodology’s six steps and the fact that many of these methodologies lack thedepth of VAM’s assessment and mitigation suggestion, it may be useful to use thecore of VAM (steps 3 and 4) during the execution of these other established method-ologies and/or formally integrating VAM’s core vulnerabilities, matrix, filtering, andsupporting information into these methods.

Next Steps and Discussion 81

Using VAM to Guide Information Attacks

The primary focus of the methodology to date has been in information system pro-tection, but the broader review of vulnerability fundamentals and attack stages couldbe useful in understanding IO/IW. A comprehensive review of what a defender maydo before, during, or after an attack in response to our own attack can also help us todesign more effective IO tools, methods, and procedures while minimizing our expo-sure.

Applications of VAM Beyond Information Systems

In addition, the explicit handling of physical, human/social, and infrastructure sys-tems raises the possibility that the methodology may be useful in assessing and miti-gating vulnerabilities in systems other than information systems. Many types of sys-tems that are critical to social functions (e.g., financial, power, transportation, agri-cultural, water, medical, law enforcement, governance) rely on physical, human/social, and infrastructure objects and include growing dependence on cyber compo-nents. RAND has not yet explored the issues in expanding the application of themethodology to these domains, but these opportunities seem promising. The list ofvulnerability properties and number of critical attack components may need to beexpanded in some of these domains (e.g., in the biological domain), but many of thefundamental properties and attack stages will likely be applicable and useful to con-sider.

WHAT VULNERABILITY WILL FAIL OR BE ATTACKED NEXT?

One of the methodology’s strong points is the ability to help the evaluator think “outof the box” and look for new vulnerabilities that have yet to cause system failures orbe exploited by attackers. This kind of review can be quite important when the sys-tem is complex or the adversary is creative and adaptive to the security responsesand postures used by the defender. For example, robustness through redundancy orperformance monitoring can be important as organizations come to rely more oncomplex information systems. Also, terrorist organizations tend to look for simple yeteasy vulnerabilities to exploit, while current security procedures often focus on solv-ing yesterday’s exploited vulnerability.

USABILITY ISSUES

Note that even if the evaluator cannot directly fix a vulnerability by implementing thesecurity techniques, the assessment can nevertheless be useful in providing a com-prehensive justification and explanation of the vulnerability to other individuals whodo have the responsibility and authority to implement remedies to the vulnerability.Such assessments and justifications can be quite important in informing others ofthe security needs and providing a basis for management budgeting and decision-making.


Note also that little discussion has been included here on how to implement specificsecurity techniques or on testing the effectiveness of the security techniques. Suchtesting as red teaming and actual attack exercises can be difficult to accomplish.Oftentimes, an organization is too busy conducting operations to run an exercisethat can take down its critical information systems. INFOCONs, for example, areusually simulated during attack exercises, and aggressive red teaming is rarely con-ducted against real operational systems. Also, standard certification for militarydeployments (e.g., inspections, certifications, assessments, and visits [ICAV], such asa Computer Network Vulnerability Assessment) runs through bottom-up vulnerabil-ities (patches, alerts, viruses, etc.) with little creative red teaming. Anderson et al.(1999) includes additional thoughts on steps 5 and 6.

WHY PERFORM SECURITY ASSESSMENTS?

Performing a security assessment can require significant investment in time andresources, but you get what you pay for. These investments might be viewed by someas unnecessary, since many vulnerabilities are known and because limited resourcesmay already prevent the implementation of security responses to the vulnerabilities.Thus, many may not see a market for comprehensive assessments or for discoveringvulnerabilities that have not yet been exploited by adversaries.

This position is shortsighted. A careful, objective review of security problems canhelp justify additional expenditures. The execution of a methodology like VAM linkssecurity investments to vulnerabilities to critical information functions, allowingmanagement to better understand the operational significance of vulnerabilities.Thus, the justifications for resource requests are expressed in the proper languageand level of functional effects rather than as mere wish lists with indeterminateeffects on the core functions of an organization.

Also, executing a methodology can help to balance limited resources, ensuring thatthe most important vulnerabilities are fixed first and that alternative security tech-niques with better cost-benefit ratios are not overlooked.

83

Chapter Nine

SUMMARY AND CONCLUSIONS

VAM fills a gap in existing methodologies by providing explicit guidance on findingsystem vulnerabilities and by suggesting relevant mitigations. The VAM methodologyprovides a comprehensive, top-down approach to information system security,combining a novel assessment and recommendation-generating matrix with filteringapproaches to refine the security options under consideration.

The methodology helps to identify new types of vulnerabilities as well as knowntypes of vulnerabilities in one’s information systems. Thus, the methodology takes acomprehensive approach to understanding vulnerabilities and does not rely oncanned scanning tools or checklists (however valuable) for the sole identifier of vul-nerabilities of concern.

The vulnerabilities and security taxonomies in the methodology are fairly complete.Viewing vulnerability properties separate from system objects has proved a valuableway of reviewing the system for vulnerabilities, since the properties often apply toeach type of object. Also, each object type plays important roles in information sys-tems. The realization and expansion of the vulnerability review to explicitly considerphysical, human/social, and infrastructure objects in addition to cyber and com-puter hardware objects recognize and accommodate the importance of all theseaspects to the proper functioning of information systems.

Providing a computerized aid that executes the methodology during an evaluationgreatly improved the usability of the methodology, especially given that the currentapproach generates many more suggestions than the earlier version by Anderson etal. (1999).

The current spreadsheet implementation in Excel has the benefit of being usable bythe large number of personal computer users that already have the Excel program ontheir machines. The spreadsheet also gives the user flexibility to generate analysisreports and even input custom rating algorithms to accommodate local needs andsituations.

The methodology can be used to improve security both during system design stagesand during operation. The methodology also identifies steps that policymakers canmake to improve information system security.


The methodology should be useful for individuals and teams. Individuals can focuson their individual situation and areas of responsibility, while teams can bring mul-tiple expertises to bear on the analyses as well as perspectives on different divisionswithin an organization. The methodology could also be used in parallel by differentdivisions to focus on their own vulnerabilities, integrating them later at a high-levelreview once each group’s needs and justifications are understood. While the VAMmethodology has proven its worth in separate studies of real information systems,the current methodology would benefit from additional development of guidance forsteps 1 and 2 and tool automation refinement. Integration with identified techniquesthat aid in the analysis of risks and the cost-effectiveness of security options wouldbe useful and is being pursued.

We also believe that the general approach of the methodology, as well as a significantportion of the vulnerability attributes, could be extended to other systems whoseprimary role is not information processing. We are also exploring these possibilities.

85

Appendix

VULNERABILITY TO MITIGATION MAP VALUES

The core of our methodology is the matrix of values that maps vulnerability attri-butes to the security techniques that can mitigate these vulnerabilities (Table 6.1). Inthe tables below we list and explain why certain techniques can be useful in mitigat-ing each vulnerability attribute. We also call attention to instances in which certainmitigation techniques can incur vulnerabilities.

Each table lists the security techniques that appear most relevant for the table’s vul-nerability attribute. The security techniques are listed in the left columns anddescriptions of why each security technique was deemed relevant is listed in the rightcolumns. Furthermore, the security techniques are grouped according to whetherthey were judged to be of primary and common importance in helping to mitigatethe vulnerability attribute, or of secondary and less common importance. Asdescribed in Chapter Six, primary techniques are identified with a numeral 2 in Table6.1, and secondary techniques are identified with a numeral 1. Some tables here alsocontain security techniques that can be facilitated by the table’s vulnerability. Whenpresent, these techniques are listed in the last rows and are identified with a numeral0 in Table 6.1.

So, for example, Table A.1 lists Heterogeneity as a primary mitigation technique forthe Singularity vulnerability attribute, and Centralization as a secondary technique.Table 6.1, therefore, has a 2 at the intersection of the Singularity attribute and thetechnique Heterogeneity, and a 1 at the intersection of the Singularity attribute andthe technique Centralization. No security techniques are identified as being facili-tated by singularities. Table A.3, however, identifies four security techniques(Centralization, Adaptability and Learning, Deception for ISR, and Law Enforcementand Civil Proceedings) that are facilitated by the Centrality vulnerability attribute.Each techniques has a 0 in the Centrality row in Table 6.1.


MITIGATION TECHNIQUES THAT ADDRESS OR ARE FACILITATEDBY VULNERABILITIES

Table A.1

Mitigation Techniques That Address Singularity

Primary

Heterogeneity Heterogeneity provides alternatives to the singular item or system.

Redundancy Redundant systems can provide a more robust capacity.

Decentralization Decentralization can introduce redundancy directly or dispersesingularities, making them harder to target.

VV&A, Software/HardwareEngineering, Evaluations,Testing

Engineering, VV&A, evaluations, and testing can make singularcomponents more robust.

Control of Exposure,Access, and Output

Control of exposure, access, and output can directly protect thesingularity.

Hardening Hardening can directly protect a singularity and make it more difficult todamage.

Fault, Uncertainty, Validity,and Quality Toleranceand Graceful Degradation

Singular components that can operate under faults and difficultconditions are less likely to fail.

Threat Response Structuresand Plans

Many response plans introduce backups and contingencies that workaround singularities.

Rapid Reconstitution andRecovery

Rapid recovery can reduce the effects of losing a singular component.

Adaptability and Learning This provides learning or adaptation materials and plans to allow othersto rapidly fill singularities.

Secondary

Centralization Centralized control can help manage access to and protect a singularity.

Trust Learning andEnforcement Systems

Trust systems can be particularly important for singular systems to helpcontrol access and exposure.

Non-Repudiation Non-repudiation can be particularly important for singular systems toprovide deterrence and evidence of untrustworthy behavior.

Static Resource Allocation Static resource allocations can help to work around and preventovertaxing singularities.

Dynamic ResourceAllocation

Dynamic resource allocations can help to work around and preventovertaxing singularities.

General Management Proper management procedures, such as quality control, training, generalsecurity, and procedural control, can help to protect singularities.

Intelligence Operations Intelligence can identify which singularities our adversaries know about.

Self-Awareness,Monitoring, andAssessments

Self-assessments can identify singularities.

GeneralCounterintelligence

CI can prevent adversaries from knowing about vulnerable singularities.

Unpredictable to Adversary CI can prevent adversaries from knowing about vulnerable singularities.

Deception for CI Deceptions can hide singularities.

Denial of ISR and TargetAcquisition

ISR denials can hide singularities.

Appendix: Vulnerability to Mitigation Map Values 87

Table A.2

Mitigation Techniques That Address Uniqueness

Primary

Heterogeneity Heterogeneity provides alternatives to the unique item or system.

Redundancy Redundant systems (even if of the same unique type) can providebackups or parts during failure of a unique system.


Engineering, VV&A, evaluations, and testing can make uniquecomponents more robust.


Control of exposure, access, and output can directly protect the uniquecomponent.

Hardening Hardening can directly protect a unique system and make it more difficultto damage.


Unique components that can operate under faults and difficultconditions are less likely to fail.


Many response plans introduce backups and contingencies that providenew alternatives to unique items.


Rapid recovery can reduce the effects of losing a unique component.

Secondary

Centralization A unique item at a central location could be monitored, maintained, andrepaired more effectively.

Decentralization Decentralization can introduce redundancy directly or disperse uniquesystems, making them harder to target.

Static Resource Allocation Static resource allocations can help to work around and preventovertaxing unique systems.


Dynamic resource allocations can help to work around and preventovertaxing unique systems.

General Management Proper management procedures, such as quality control, training, generalsecurity, and procedural control, can help to protect unique systems.

Intelligence Operations Intelligence can identify which unique components our adversaries knowabout.


Self-assessments can identify uniqueness in our systems.

General CI CI can prevent adversaries from knowing about unique, vulnerablecomponents.

Unpredictable to Adversary CI can prevent adversaries from knowing about unique, vulnerablecomponents.

Deception for CI Deceptions can hide the uniqueness of components.


ISR denials can hide the uniqueness of components.

Criminal and LegalPenalties and Guarantees

Warrantees and guarantees serve as useful ways to certify the capabilitiesand stability of unique items and can provide (often longer-term)remedies for failures.


Table A.3

Mitigation Techniques That Address or Are Facilitated by Centrality

Primary

Decentralization Decentralization directly addresses centrality concerns.


Engineering, VV&A, evaluations, and testing can make centralizedsystems more robust.


Control of exposure, access, and output can directly protect centralizedcomponents.

Hardening Hardening can directly protect a centralized system and make it moredifficult to damage.


Centralized systems that can operate under faults and difficult conditionsare less likely to fail.


Many response plans develop ways to protect and back up centralizedcapabilities.

Preventive and RetributiveInformation/MilitaryOperations

Centralized facilities are often higher-value targets for adversaries, thuswarranting a strong and aggressive response if damaged.

Secondary

Heterogeneity Heterogeneity reduces the variety of systems that would have to becompromised, even if they are still maintained at a central site.

Redundancy Even if centralized, redundant systems can provide more-robustcapability.


Trust systems can be particularly important for centralized systems tohelp control access and exposure.

Non-Repudiation Non-repudiation can be particularly important for centralized systems toprovide deterrence and evidence of untrustworthy behavior.

General Management Proper management procedures, such as quality control, training, generalsecurity, and procedural control, can help to protect centralizedsystems.


Rapid recovery can reduce the effects of losing the centralizedcomponents and can in fact be facilitated by centrality.

Immunological DefenseSystems

The ability of these systems to share information with decentralizednodes can mitigate the reason(s) for centrality.

Intelligence Operations Intelligence can identify which singularities our adversaries know about.


Self-assessments can characterize the scope of our dependence oncentralized systems.

General CI CI can prevent adversaries from locating and characterizing ourcentralities.

Unpredictable to Adversary CI can prevent adversaries from locating and characterizing ourcentralities.

Deception for CI Deceptions can hide the centrality of a system.


ISR details can hide the centrality of a system.


Table A.3—Continued

Facilitated by Centrality

Centralization Leverage centrality to maximum advantage (e.g., quality control,consistency).

Adaptability and Learning Centrality can facilitate learning and adaptation through improved self-awareness and feedback. Dissemination of lessons learned is alsofacilitated by centrality.

Deception for ISR Centrality could enable and coordinate deception to improve ISR.

Law Enforcement; CivilProceedings

Centralized items are often easier for law enforcement to protect.

Table A.4

Mitigation Techniques That Address or Are Facilitated by Homogeneity

Primary

Heterogeneity Heterogeneity is the opposite of homogeneity, introducing a range ofdifferent alternative systems.


Engineering, VV&A, evaluations, and testing can be more extensive onhomogeneous systems and make them more robust than heterogeneoussystems.

Hardening Hardening a homogeneous system can make it less vulnerable to attack.Fault, Uncertainty, Validity,

and Quality Toleranceand Graceful Degradation

Homogeneous systems that can operate under faults and difficultconditions are less likely to fail in general.

Secondary

Redundancy While not reducing the homogeneity, redundant items can make thosesystems more robust and able to withstand failures.

Decentralization Dispersal of homogeneous targets makes them harder to attack all atonce.


Control of exposure, access, and output can directly protecthomogeneous components. Homogeneous systems can facilitatecontrol design.

General Management Proper management procedures, such as quality control, training, generalsecurity, and procedural control, can help to protect homogeneoussystems. Note that homogeneous systems can help facilitatemanagement of information systems.


Self-assessments can determine how heterogeneous our systems havebecome.

General CI CI can prevent adversaries from understanding what systems we havestandardized on.

Unpredictable to Adversary CI can prevent adversaries from understanding what systems we havestandardized on.

Deception for CI False heterogeneity can hide reliance on homogeneous components.Denial of ISR and Target

AcquisitionISR denials can prevent adversaries from understanding what systems we

have standardized on.

Facilitated by Homogeneity

Static Resource Allocation Note that homogeneous systems can facilitate resource allocations.Dynamic Resource

AllocationNote that homogeneous systems can facilitate resource allocations.

General Management Proper management procedures, such as quality control, training, generalsecurity, and procedural control, can help to protect homogeneoussystems. Note that homogeneous systems can help facilitatemanagement of information systems.




Homogeneity can facilitate reconstitution and recovery due to theavailability of alternative systems and parts as well as common trainingand knowledge about those components.


Homogeneity can make it easier to apply lessons learned from othernodes.

Vaccination Homogeneity can make it easier to apply lessons learned from othernodes.

Table A.5

Mitigation Techniques That Address or Are Facilitated by Separability

Primary

Centralization Centralized systems will be harder to separate.VV&A, Software/Hardware

Engineering, Evaluations,Testing

Engineering, VV&A, evaluations, and testing can look for ways that systemcomponents can be isolated and develop ways to reduce thisvulnerability.


Systems that can operate despite degraded conditions and uncertaintyare harder to partition.

General Management Proper management and coordination can help ensure cohesion andcommunication.


Monitoring can determine breaks in system interfaces, facilitating theirrestoration. Assessments can identify how separations have happenedin the past, informing corrective measures.

Secondary


Control of exposure, access, and output can protect against separability.


Trust systems can inform interface controllers and reduce the likelihoodof deceptive separations.

Hardening Hardening system interfaces can make them more difficult to break.Adaptability and Learning Adaptation could help to learn and recognize attempts to partition the

system.Immunological Defense

SystemsInformation sharing can preclude the need to isolate systems under

attack and share information about such attacks and how to defendagainst them.

Vaccination Simulated attacks could uncover separability risks and force mitigationevaluations.

Intelligence Operations Information about attacks can speed efforts to reconnect componentsand tune our own partitioning activities.

General CI CI can reduce an adversary’s understanding of how to separate systemcomponents.

Unpredictable to Adversary CI can reduce an adversary’s understanding of how to separate systemcomponents.

Deception for CI Deceptions can make it harder to know how to separate systemcomponents.


ISR denials can reduce an adversary’s understanding of how to separatesystem components.

Facilitated by Separability

Deception for ISR Known separabilities can be used in our deceptions to determineadversary’s general knowledge, capabilities, and specific knowledgeabout us.


Table A.6

Mitigation Techniques That Address Logic or Implementation Errors, Fallibility

Primary

Heterogeneity A variety of systems can complement each other if the systems havedifferent failure conditions.


Engineering, VV&A, evaluations, and testing can identify errors andfallibilities while recommending solutions.


Exposure, access, and output controls can be used to isolate the rest of thesystem from component errors and fallibilities.

Hardening Hardening can remove errors and make it less fallible.


Tolerant systems are able to handle errors better when they happen.

General Management Management reviews and quality control can help to recognize and avoiderrors and fallibilities.

Adaptability and Learning Examination of performance can help to locate errors and adjust to them.


Some systems automatically recognize, update, patch, or correct errors.

Vaccination Vaccination uncovers and repairs errors directly.

Secondary

Centralization Flawed systems will be easier to manage, control, and repair if they are ata central location.

Decentralization It can be harder to understand and exploit the errors in systems whenthey are dispersed.


Trust learning can reduce fallibilities due to excessive accesses andreasoning about protections.

Static Resource Allocation Resource allocations can work around errors and failures.


Resource allocations can work around errors and failures.


Many response plans introduce backups and contingencies that reducefallibilities or minimize the effects of errors.


A rapid recovery capability reduces (but usually does not eliminate) theeffect of component losses and errors.


Monitoring and assessments can look for errors and fallibilities.

General CI CI can reduce an adversary’s understanding of system errors andfallibilities.

Unpredictable to Adversary CI can reduce an adversary’s understanding of system errors andfallibilities.

Deception for CI Deceptions can reduce an adversary’s understanding of system errors andfallibilities.


ISR details can reduce an adversary’s understanding of system errors andfallibilities.


Warrantees and bonding can provide remediation for failed systems andmotivate manufacturers to eliminate problems in the first place.


Warrantees and bonding can provide remediation for failed systems.


Table A.7

Mitigation Techniques That Address or Are Facilitated by Design Sensitivity,Fragility, Limits, or Finiteness

Primary

Heterogeneity A variety of systems can complement each other if they have differentsensitivities, fragilities, operating ranges, or limit dimensions.

Redundancy Redundant systems can provide fallback capability or help spread theprocessing load if limits are reached.

Decentralization It can be harder to understand and exploit the fragilities and limits insystems when they are dispersed. Decentralization can also introduceimproved capacity that might be exploited if information processing canbe partitioned. Dispersed systems can also be used as alternativecapacity when local limits are reached.


Engineering, VV&A, evaluations, and testing can identify and resolvesensitivities, fragilities, and limits.


Controls can help to protect fragile systems from harsh environments oroverloading attacks.

Hardening Hardening can make the design less fragile.


Tolerant systems are able to handle fragilities, sensitivities, and limitsbetter when they happen.

Static Resource Allocation Resource allocations can balance loads to prevent failures and partitionwork to avoid sensitivities.


Resource allocations can balance loads to prevent failures and partitionwork to avoid sensitivities.

General Management Attentive management can avoid overloading systems and stressingfragile components.


Status monitoring can help management prevent the system fromcrossing limits, avoid sensitivities, etc. Assessments can continue toidentify unknown fragilities and limits.

Secondary

Centralization Fragile and limited systems will be easier to control their loads and inputsif centralized.


Response plans can provide additional resources to minimize limits andthe effects of design sensitivities if they are known.


A rapid recovery capability reduces (but usually does not eliminate) theeffect of component losses due to fragility and crossing limitations.

Adaptability and Learning Examination of performance can help to locate fragilities and limits whiledeveloping work-arounds.


Some systems automatically alert, fuse, recognize, update, patch, andcorrect sensitivities.

Vaccination Vaccination uncovers fragilities and limits directly. Some may becorrected directly, while others could be avoided in the future.

Intelligence Operations Information on attacks that target limitations and sensitivities can beused to plan and implement countermeasures.

Attack Detection,Recognition, DamageAssessment, andForensics (Self and Foe)

Behavior and condition monitoring can help to characterize sensitivities,limits, and fragilities.

General CI CI can reduce an adversary’s understanding of system sensitivities andlimits.

Unpredictable to Adversary CI can reduce an adversary’s understanding of system sensitivities andlimits.



Deception for CI Deceptions can reduce an adversary’s understanding of systemsensitivities and limits.


ISR denials can reduce an adversary’s understanding of systemsensitivities and limits.





Facilitated by Design Sensitivity, Fragility, Limits, or Finiteness

Deception for ISR Known sensitivities can be used in our deceptions to determineadversary’s general knowledge, capabilities, and specific knowledgeabout us.

Table A.8

Mitigation Techniques That Address Unrecoverability

Primary

Heterogeneity Different systems may fail at different times, helping to avoid a completesystem failure.

Redundancy Redundant systems can provide fallback capability in the event of anunrecoverable failure.

Decentralization Decentralized operations can provide alternative capacity if parts of thesystem fail.


Engineering, VV&A, evaluations, and testing can help to identify why asystem is unrecoverable and can recommend remedies.

Hardening Hardening can make the system less likely to fail in the first place.


Tolerant systems are less likely to fail in the first place.


Rapid reconstitution and recovery directly addresses unrecoverability.


Early detection of unrecoverable failures can speed the implementationof recovery procedures, inform how to avoid failures in the future, andinform ways to make the systems more recoverable in the first place.

Secondary

Centralization Unrecoverable systems will be easier to protect from failure in the firstplace if they are in a central location close to management.


Partitions and isolations can help to limit the scope of damage from anunrecoverable component.

Static Resource Allocation Resource allocations can sometimes work around unrecoverable failures.


Resource allocations can sometimes work around unrecoverable failures.

General Management Management can help avoid failure in the first place.


Response plans can provide backups and contingencies in the event ofunrecoverable failures.

Adaptability and Learning Learning can help to avoid unrecoverable conditions in the future.


Unrecoverability may be preempted on other systems once an attack isrecognized and understood.

Vaccination Attacks can highlight unrecoverabilities and might introduce mitigationideas.



Intelligence Operations ISR can inform us of attacks and prompt us to protect unrecoverableassets. It can also inform us of specific attacks and help filter them.


Better analysis of failures can help to understand what caused the failure,avoid failure conditions in the future, and correct failure modes in thefirst place.

General CI CI can reduce an adversary’s understanding of what components areunrecoverable.

Unpredictable to Adversary CI can reduce an adversary’s understanding of what components areunrecoverable.

Deception for CI Deceptions can reduce an adversary’s understanding of whatcomponents are unrecoverable.


ISR denials can reduce an adversary’s understanding of what componentsare unrecoverable.





Table A.9

Mitigation Techniques That Address Behavioral Sensitivity or Fragility

Primary

Heterogeneity Heterogeneous systems with different sensitivities and fragilities canprovide alternative capabilities.

Redundancy Redundant systems can help to compensate for behavioral sensitivitiesand fragilities.

Decentralization It can be harder to understand and exploit the fragilities and limits insystems when they are dispersed. Also, dispersed systems ofautonomous, heterogeneous entities can provide more-robust behavior.


Engineering, VV&A, evaluations, and testing can identify and resolvebehavioral sensitivities and fragilities.


Controls can help to protect fragile systems from harsh environments oroverloading attacks.

Hardening Hardening can make the behavior less fragile and sensitive.

Fault, Uncertainty, Validity,and Quality Tolerance andGraceful Degradation

Tolerant systems are able to handle fragilities, sensitivities, and limitsbetter when they happen.

Static Resource Allocation Resource allocations can balance loads to prevent failures and partitionwork to avoid sensitivities.


Resource allocations can balance loads to prevent failures and partitionwork to avoid sensitivities.

General Management Attentive management can avoid stressing fragile components andcontrol behavioral sensitivities.


Status monitoring can help management prevent the system fromcrossing entering sensitive operating conditions. Assessments cancontinue to identify unknown fragilities and sensitivities.

Secondary

Centralization Behavioral sensitivities and fragilities are easier to observe and manage ifthey are centralized.




Response plans can provide additional resources to minimize limits andthe effects of design sensitivities.


A rapid recovery capability reduces (but usually does not eliminate) theeffect of component losses due to fragility and crossing limitations.

Adaptability and Learning Examination of performance can help to locate fragilities and limits whiledeveloping work-arounds.


Some systems automatically alert, fuse, recognize, update, patch, andcorrect sensitivities.

Vaccination Vaccination uncovers fragilities and limits directly. Some may becorrected directly, while others could be avoided in the future.

Intelligence Operations Information on attacks that target sensitivities and fragilities can be usedto plan and implement countermeasures.


Behavior and condition monitoring can help to characterize sensitivities,limits, and fragilities.

General CI CI can reduce an adversary’s understanding of system sensitivities andfragilities.

Unpredictable to Adversary CI can reduce an adversary’s understanding of system sensitivities andfragilities.

Deception for CI Deceptions can reduce an adversary’s understanding of systemsensitivities and fragilities.


ISR details can reduce an adversary’s understanding of systemsensitivities and fragilities.





Table A.10

Mitigation Techniques That Address Malevolence

Primary


Engineering, VV&A, evaluations, and testing can identify and resolvemalevolent tendencies.


Controls can help to keep out or wrap malevolent components, isolatingcritical systems, and performing deeper checks for malevolence incritical areas.


Trust learning and enforcement systems can help to identify and controlmalevolent behavior and entities.

Non-Repudiation Non-repudiation can add source information to malevolent behaviorsand provide deterrence to malevolent entities.

General Management Management can actively monitor for malevolent actors.

Intelligence Operations Intelligence can specifically look for malevolent actors.


Monitoring can identify malevolent actors early on.

Deception for ISR Deceptions can be valuable ways to draw out malevolent actors.




Monitoring and assessments directly look for malevolent actors.

General CI CI looks for malevolent insiders that are supplying intelligence on thesystem.

Unpredictable to Adversary CI looks for malevolent insiders that are supplying intelligence on thesystem.

Deception for CI Deceptions can identify malevolent insiders supplying intelligence on thesystem.


ISR detail can help prevent malevolent actors from knowing where tostrike.

Deterrence Deterrence can dampen malevolent tendencies.


Active operations can eliminate or contain malevolent actors.


Penalties can deter malevolent actors or actively restrain them if caught.


Enforcement can restrain malevolent actors.

Secondary

Heterogeneity Different systems may have different malevolent tendencies, weaknesses,or even lack malevolence altogether, mitigating the risks from themalevolent system.

Redundancy Redundancy could reduce the effectiveness of a single system gone bad.

Decentralization Malevolent entities are less effective when control and processing isdispersed, since it requires more effort and purview over a wider rangeof dispersed systems.


Well-developed plans can reduce the access of and damage done bymalevolent actors.


Monitoring and sharing will reduce the ability of malevolent entities toremain hidden or to jump to new systems and remain undetected.

Vaccination Simulated attacks can sensitize the system to malevolence.

Table A.11

Mitigation Techniques That Address Rigidity

Primary


Engineering, VV&A, evaluations, and testing can identify rigidities andrecommend remedies.


Trust systems adapt system accesses and information use to changingbehaviors and new entities.


Tolerant systems are more accepting and can operate in broader rangesof inputs.


Dynamic allocations should adjust to current conditions.

General Management Active management can react to new problems and pursue solutions.


Plans can be adaptive to the current situation, especially when theyprovide general context, arrangements, and alternatives in which localresponders can work.




Rapid reconstitution and recovery can provide flexibility through failureresponsiveness.

Adaptability and Learning Dynamic adaptation and learning can adjust system configurations tomatch current needs.


These systems look for new threats and solutions. When found, theyshare information and provide rapid updates and changes to the system.

Vaccination Vaccination shows where the system needs to be changed.

Secondary

Heterogeneity Different systems may be rigid in different ways. Their differences mayhighlight rigidities in the original system.

Decentralization Decentralized systems tend to be more innovative, flexible, and adaptiveto local conditions.

Static Resource Allocation Static allocations can introduce some level of response to currentconditions.


Monitoring and assessments can identify rigidities.


Understanding attacks often lead to internal changes to improve security.

General CI CI can reduce an adversary’s understanding of the system’s rigidities.

Unpredictable to Adversary CI can reduce an adversary’s understanding of the system’s rigidities.

Deception for CI Deceptions can reduce an adversary’s understanding of the system’srigidities.


ISR denial can reduce an adversary’s understanding of the system’srigidities.

Table A.12

Mitigation Techniques That Address Malleability

Primary


Engineering, VV&A, evaluations, and testing can identify where thesystem is malleable and can recommend remedies.


Trust systems introduce more rigor and oversight to make it harder tocontrol and manipulate the information system.

Hardening Hardening can make the system less changeable and less modifiable.

General Management Management oversight can monitor for undesirable changes andmanipulations.


Plans provide structure to the operation and contingency, reducing thelikelihood that the system can be manipulated.


Systems are harder to manipulate if they are self-aware and can see if youare trying to manipulate them.

Deterrence Deterrence can sensitize actors and make them less controllable.

Secondary

Heterogeneity Different systems may have different maleabilities.

Centralization Centralized systems can be more effectively controlled and thus lessprone to manipulation.



Decentralization It is harder to change an entire distributed system than a centralized,monolithic one.


Controls make it less likely that a system can be changed without properauthorization.

Non-Repudiation Systems can be less likely to be manipulated if source information isalways provided.

Static Resource Allocation Preplanned allocations can prevent manipulation of allocationconfigurations.

Adaptability and Learning The system will be less likely to be manipulated if it actively examinesperformance and adjusts to new situations.


Understanding and knowledge of attacks can make entities lesscontrollable and can identify unprotected control points for futureremediation.

General CI CI can reduce an adversary’s understanding of the system’s controlpoints and manipulabilities.

Unpredictable to Adversary CI can reduce an adversary’s understanding of the system’s controlpoints and manipulabilities.

Deception for CI Deceptions can reduce an adversary’s understanding of the system’scontrol points and manipulabilities.


ISR denial can reduce an adversary’s understanding of the system’scontrol points and manipulabilities.


The existence of penalties can make deterrence more effective.

Table A.13

Mitigation Techniques that Address Gullibility, Deceivability, or Naiveté

Primary


Engineering, VV&A, evaluations, and testing can examine systemgullibility and recommend compensations.


Trust systems introduce more rigor and oversight to make it harder tofool the information system.

Hardening Hardening can make the system more knowledgeable and insistent onreliable information sources.

General Management Management oversight can monitor for undesirable changes, share threatknowledge, and provide advice.


Plans provide structure to the operation and contingency, reducing thelikelihood that the system can be blindly manipulated.

Adaptability and Learning Attention and adaptation to the current situation can reduce blindbehavior.

Vaccination Simulated attacks can sensitize the system and make it less gullible.

Intelligence Operations Intelligence can provide information about our adversaries and theirtechniques.


Systems are harder to manipulate if they are self-aware and can see if youare trying to manipulate them.

Secondary


Controls are often implemented with significant forethought and canavoid some naive conditions.

Non-Repudiation It can be harder to deceive a system if source information is provided.



Static Resource Allocation Static allocations often are well engineered in advance.


The adaptive, sharing, and automatic maintenance nature of thesesystems makes it harder to attack parts of the system based onnoncompliance or ignorance of the latest information.


Understanding and knowledge of attacks can make entities less gullibleand less naive to the same ruses.

General CI CI can reduce an adversary’s understanding of system biases andoperations, making it more difficult to manipulate it.

Unpredictable to Adversary CI can reduce an adversary’s understanding of system biases andoperations, making it more difficult to manipulate it.

Deception for CI Deceptions can reduce an adversary’s understanding of system biasesand operations, making it more difficult to manipulate it.


ISR denial can reduce an adversary’s understanding of system biases andoperations, making it more difficult to manipulate it.

Table A.14

Mitigation Techniques That Address Complacency

Primary


Engineering, VV&A, evaluations, and testing can help to keep systemsfrom being complacent by identifying weaknesses and ensuring properprocedures.


Trust systems adapt system accesses and information use to changingbehaviors and new entities.


Dynamic attention to resource allocation draws attention to currentconditions.

General Management Active management can continue to look for and adapt to new threats.


Planning engages people in active consideration of vulnerabilities andsets up contingency systems to facilitate response.

Adaptability and Learning Attention and adaptation to the current situation and systemperformance directly reduce complacency.


These systems are always on the alert for suspicious activity andproblems.

Intelligence Operations Current and detailed understanding of adversary activities can motivateus out of complacency.


Direct knowledge of internal activities and attacks can motivate people toaction.

Deterrence Warnings and penalties can deter actors from becoming complacent.

Secondary

Centralization Centralization can introduce regularly scheduled security reviews andprocedures, thus reducing complacency.


Additional attention to controls can reduce complacency if they areactively maintained and improved.

Vaccination Simulated attacks can sensitize the system and keep it alert.


Knowledge of the real dangers based on prior attacks will make entitiesless complacent. Automated analysis systems can be tied to protectivesystems and directly reduce complacency.



General CI Knowledge about intelligence risks can motivate people to pay betterattention to security.

Unpredictable to Adversary Knowledge about intelligence risks can motivate people to pay betterattention to security.

Deception for CI Knowledge about intelligence risks can motivate people to pay betterattention to security.


Penalties can make warnings and deterrence more intimidating.

Table A.15

Mitigation Techniques That Address Corruptibility or Controllability

Primary


Engineering, VV&A, evaluations, and testing can identify and remedyweaknesses that can be exploited.


Control filters can protect against common control problems andvulnerabilities.


Trust systems introduce more rigor and oversight to make it harder tocontrol and manipulate the information system.

Hardening Hardening can make the system more knowledgeable and insistent onreliable information sources.

General Management Management oversight can monitor for undesirable changes andmanipulations.


Use of the latest and best security knowledge and procedures will make itharder to directly attack the system.

Intelligence Operations Intelligence can monitor for corruption directly and identify adversarycapabilities and activities that indicate control and access to yoursystem.


Self-monitoring can identify corruption. Assessments can identifycontrollability points and corruptibility danger signs (e.g., personalproblems, careless behavior).

Deterrence Deterrence can reduce corruptibility and controllability of actors.

Secondary

Heterogeneity Different systems may have different corruptible or controllableweaknesses or have such weaknesses in different areas so they can helpcompensate for the other’s weaknesses.

Centralization Centralized control can help to monitor and deal with corruption andusurped control.

Decentralization It is harder to corrupt or control an entire distributed system than acentralized, monolithic one.

Non-Repudiation Some repudiation systems protect information content from corruptionor confirm the source of system updates.

Vaccination Simulated attacks can sensitize the system and keep it alert tocorruptions.


Understanding and knowledge of attacks can make entities lesscontrollable and can identify unprotected control points for futureremediation.

General CI Assessments can identify controllability points and corruptibility dangersigns (e.g., personal problems, careless behavior).



Unpredictable to Adversary Assessments can identify controllability points and corruptibility dangersigns (e.g., personal problems, careless behavior).

Deception for CI Deceptions can reduce an adversary’s understanding of the system’scontrol points and corruptibility.



Table A.16

Mitigation Techniques That Address Accessible, Detectable, Identifiable,Transparent, or Interceptable

Primary

Decentralization Decentralized systems are harder to detect, identify, track, access, andintercept in their entirety.


Engineering, VV&A, evaluations, and testing can examine and remedyweaknesses that can be exploited.


These controls are directly designed to reduce accessibilities,detectabilities, and interceptions.


Trust systems can adapt system restrict accesses and exposures to reliableentities.

Hardening Hardening can make the system less accessible, less interceptable, andless likely to be damaged if access is compromised.


Tolerant systems can be less likely to be compromised or damaged ifaccess is compromised.


Response plans can reduce visibility and exposure based on (perceived)threats and conditions.

General CI CI works directly to minimize adversarial capability to detect, identify,access, and intercept system components.

Unpredictable to Adversary CI works directly to minimize adversarial capability to detect, identify,access, and intercept system components.

Deception for CI Deceptions can directly mask detections, identifications, andtransparencies.


Denials can directly mask detections, identifications, and transparencies.

Deterrence Deterrence can increase the cost of monitoring and interception whilemaking them more evident.


Active retributions can protect access points, increase the cost ofmonitoring and interception, and make compromises more evident.

Secondary

Heterogeneity A range of different system types would be harder to track, identify, andaccess.

Redundancy Multiple systems can be harder to identify and track.

General Management Active and well-planned management can help to minimize exposuresand interceptions.


Vigilance and automatic sharing can keep exposure controls at their peak.

Vaccination Attacks on exposure controls can strengthen our understanding of theirweaknesses, identify misconfigurations, and motivate action.



Intelligence Operations Intelligence about adversary’s sensor capabilities can inform ourcountermeasure designs and operating procedures.


The more we understand our own systems and their exposure, the betterwe can design countermeasures to protect them.


Detection and forensics can identify weak points while possibly informingattack interception mechanisms in a current attack.




Enforcement can provide physical protection at access points.

Table A.17

Mitigation Techniques That Address Hard to Manage or Control

Primary

Centralization Centralization can make it easier to manage and control operations.


Engineering, VV&A, evaluations, and testing can examine why the systemis hard to manage and control while making recommendations on howto improve these functions.


Exposure, access, and output control structures can help in themanagement and control of the information flow into, out of, andwithin the information system.


Trust systems can introduce more rigor and support to management ofthe system, especially in environments containing entities of unknownreliability.

Static Resource Allocation Resource allocation schemes introduce additional management controlstructures.


Resource allocation schemes introduce additional management controlstructures.

General Management Additional attention to management structures and control points canhelp to bring systems under control.


Plans and contingencies provide additional ways to manage and controlthe system.


Self-information is a key prerequisite to effective management andcontrol.

Secondary


The automatic nature of the system facilitates management, especially ofdistributed and diverse systems.


Improved understanding of operations and weaknesses can improvemanageability.

Deterrence Deterrence is a management tool to help control actors’ behavior.


Penalties can strengthen management’s actions and warnings.


Enforcement shows that disregard for management’s actions will result inreal penalties.


Table A.18

Mitigation Techniques That Address Self-Unawareness or Unpredictability

Primary

Centralization Centralization can make it easier to monitor and understand operations.


Engineering, VV&A, evaluations, and testing can identify and resolvelimits in self-awareness and unpredictability.


Trust systems add monitors to be more aware of what is happening in thesystem and attributing actions to entities.


The self-monitoring component of these systems helps to provide insightinto systemwide status and behavior.

Vaccination Simulated attacks will provide additional information and insights intothe information system and its operation under stress.


New techniques to gather information about our own system can directlyaddress these deficiencies.


Monitoring and analysis will improve knowledge and awareness of theinformation system.

Secondary

Static Resource Allocation Resource allocations provide state information about the informationsystem and its processing.


Resource allocations provide state information about the informationsystem and its processing.

General Management Self-knowledge is an important step in setting up management structuresand controls.


Plans often introduce new sources of information about one’s ownsystem and control structures to reduce unpredictability.

General CI CI often requires a sound understanding of our system as an intelligencetarget.

Unpredictable to Adversary CI often requires a sound understanding of our system as an intelligencetarget.

Deception for CI Deceptions often require a sound understanding of our system as anintelligence target.

Table A.19

Mitigation Techniques That Address or Are Facilitated by Predictability

Primary

Heterogeneity A range of different system types will require more resources tounderstand and predict how they will operate, especially if theirinteractions yield emergent behaviors.


Engineering, VV&A, evaluations, and testing can identify and resolveexcessive predictabilities in the system.


Dynamic allocations can be less predictable, since they rely on currentconditions.

Adaptability and Learning Adaptation provides a moving target for the adversary to understand.


The ability to rapidly insert modifications across the system can make itharder for an adversary to maintain a common operating picture of theinformation system and its configuration.



General CI A major goal of counterintelligence is to reduce our adversary’s ability topredict how our system works.

Unpredictable to Adversary A major goal of counterintelligence is to reduce our adversary’s ability topredict how our system works.

Deception for CI Deceptions can make the information system harder to understand andpredict.


Denial of enemy ISR interferes with the enemy’s ability to predict theinformation system’s structure and function.

Secondary

Decentralization Decentralized systems often contain a degree of autonomy andheterogeneity, making them less predictable.


Controls can make it harder for adversaries to predict how the system isconfigured inside the protected areas.

General Management Active and well-planned management can help to minimizedissemination of information about the information system.


Plans can introduce adaptive alternatives and resources that make thesystem less predictable.

Vaccination Repeated red teaming can keep the system in continual maintenance andmake it less predictable.


Detection and forensics can identify predictable weak points that requirecorrective attention.

Facilitated by Predictability

Deception for ISR Predictabilities can be leveraged to dupe the attacker or prober to seehow they behave and how much they know.


VULNERABILITIES THAT CAN BE INCURRED BY SECURITY TECHNIQUES

No vulnerability cautions have been identified for the following security techniques:

• Denial of ISR and Target Acquisition

• Preventive and Retributive Information/Military Operations

Table A.20

Vulnerabilities That Can Be Incurred from Heterogeneity

Primary Cautions

Hard to Manage or Control A variety of different system types can be difficult to manage, maintain,and interoperate.

Self-Unawareness andUnpredictability

A variety of different system types can be difficult to monitor and predicthow they are interacting and operating.

Secondary Cautions


A collection of heterogeneous systems may introduce design fragilities orlowest-common-denominator limits.

Behavioral Sensitivity/Fragility

A collection of heterogeneous systems may introduce behavioralsensitivities or fragilities due to their operating differences ormanagement challenges.

Table A.21

Vulnerabilities That Can Be Incurred from Redundancy

Secondary Cautions

Separability Redundant systems (especially if located in different places) might beisolated and attacked separately.


Redundant, heterogeneous systems could introduce voting paradoxeswhere the “best” decision may not be reached (e.g., decisions bycommittee are often weak compromises).

Hard to Manage or Control Redundant systems could be harder to manage if proper procedures arenot in place to control their interactions and to force proper decisions.

Table A.22

Vulnerabilities That Can Be Incurred from Centralization

Primary Cautions

Centrality Centralization introduces centrality directly by definition and must bejudiciously implemented.

Rigidity Centralized systems can become more stated and rigid, since they tend toreduce creative exploration and the use of alternative approaches.

Accessible/Detectable/Identifiable/Transparent/Interceptable

Centralization can make it easier for adversaries to locate, detect, andidentify operations.



Secondary Cautions

Singularity Centralization could introduce singularities in the name of cost savings.

Homogeneity Centralization efforts may have a tendency to homogenize the systems tosimplify management and save money.

Complacency Some centralized systems become complacent, since they are believed tobe more robust.

Corruptibility/Controllability

Centralized systems have control logic and paths that may be usurped.

Predictability Centralized operations tend to be more stated, predefined, predictable,and less innovative.

Table A.23

Vulnerabilities That Can Be Incurred from Decentralization

Primary Cautions

Separability Dispersed items are easier to isolate and attack separately.

Hard to Manage or Control Dispersed, decentralized systems can be harder to manage and control,since they require an extensive C4I coordination system.


It is harder to understand and track the operations of a decentralizedsystem.

Secondary Cautions

Logic/ImplementationErrors; Fallibility

The logic and interoperability components in a decentralized system canmake the system more complex and more prone to errors.


The logic and interoperability components in a decentralized system canmake the system more complex and more prone to sensitivities andlimits due to synchrony, coordination, and communication limitations.


Decentralized systems (especially as they become more complex) canhave behavioral anomalies.

Malleability Decentralized, innovative nodes with less-centralized and -structuredcontrol might have less-rigorous testing and thus be more malleable.

Gullibility/Deceivability/Naiveté

Decentralized, innovative nodes with less-centralized and -structuredcontrol might have less-rigorous management and thus be moregullible.

Table A.24

Vulnerabilities That Can Be Incurred from VV&A, Software/HardwareEngineering, Evaluations, Testing

Secondary Cautions

Complacency The existence of engineering, VV&A, evaluations, and testing can make asystem’s users and managers feel that it has already accounted forcritical vulnerabilities and hence will become complacent, especially tonovel threats.

Predictability The use of standard engineering, VV&A, evaluations, and testing (andtheir reports and documentations) can introduce predictabilities in thesystem operations.


Table A.25

Vulnerabilities That Can Be Incurred from Control of Exposure, Access, and Output

Primary Cautions

Separability These controls often introduce separations and could be exploited toseparate parts of an otherwise functioning system. Such separations candegrade overall performance while improving security.

Rigidity Controls can make the system more rigid in general and harder to modifyquickly.

Secondary Cautions

Centrality Controls are often centralized and may introduce another point ofvulnerability.


Controls can introduce limits and sensitivities, since their filters are oftenimperfect and can interfere with legitimate communication.

Unrecoverability Restricted communications can make it harder to monitor and quicklyaccess systems for recovery purposes.


Controls can introduce limits and sensitivities, since their filters are oftenimperfect and can interfere with legitimate communication.


Any control relies on the use of a bias function to filter the interface; ifunderstood, this bias can be exploited to deceive the control.

Complacency Systems with extensive control are often thought of as secure and canbecome complacent to their imperfections.


Extra control structures always introduce another point of potentialcontrollability and corruption.

Hard to Manage or Control Sophisticated control structures can be difficult to manage and control,requiring extensive training, experience, and knowledge.


Restricted accesses and controls can make it harder to monitor internalsystem conditions and predict how the system will perform.

Predictability Some control systems are standard in the industry, with predictablelimitations and default configurations.

Table A.26

Vulnerabilities That Can Be Incurred from Trust Learning and Enforcement Systems

Secondary Cautions

Separability Some trust models can be manipulated by introducing false informationthat separates trustworthy entities.

Malleability Some trust models can be manipulated by introducing false informationin order to establish trust.


Models that gauge trusted behavior might be fooled if the bias function isknown to an adversary.

Complacency The use of a trust system can cause complacency if its limitations are notrecognized and incorporated into vulnerability assessments.


Table A.27

Vulnerabilities That Can Be Incurred from Non-Repudiation

Secondary Caution

Complacency Rigorous non-repudiation can seem to provide significant securityprotections, but the information must be acted upon for it to be ofmaximal value.

Table A.28

Vulnerabilities That Can Be Incurred from Hardening

Primary Caution

Rigidity Hardening could make the system more rigid.

Secondary Cautions


Sometimes hardening is at the expense of capacity.

Complacency Hardened systems might be thought of as invulnerable.

Hard to Manage or Control Rigid, hardened systems can be hard to manage or control, especially tochanging conditions.


Some hardening approaches can make it harder to monitor andunderstand what is going on in the system and how it will react.

Predictability Rigid, hardened systems can be more predictable to a knowledgeableadversary.

Table A.29

Vulnerabilities That Can Be Incurred from Fault, Uncertainty, Validity, andQuality Tolerance and Graceful Degradation

Secondary Cautions


Sometimes systems with graceful degradation operate in a degradedfashion under conditions where other systems would operate flawlessly.

Complacency Tolerant systems might be thought of as invulnerable.


Some tolerant and gracefully degrading approaches are hard for humansto understand how they work.

Table A.30

Vulnerabilities That Can Be Incurred from Static Resource Allocation

Primary Cautions

Separability Resource allocations can be exploited to attack or overwhelm partitionsallocated to particular problems.

Rigidity Static allocations might become inappropriate for the current situation.


Adversaries could manipulate the system into less-desirableconfigurations. Static allocations may be inappropriate for currentconditions.

Predictability Static allocation plans introduce predictabilities if they are known.



Secondary Cautions

Centrality Static resource allocations may require centralized monitoring andcontrol.

Malleability Dynamic allocation triggers could be manipulated with activity to movethe system into less-desirable configurations.

Complacency The existence of allocation plans may make one feel overly secure.

Table A.31

Vulnerabilities That Can Be Incurred from Dynamic Resource Allocation

Secondary Cautions

Centrality Dynamic resource allocations may require centralized monitoring andcontrol.

Separability Some allocation approaches may be exploited to cut off parts of thesystem.


Some dynamic resource allocations can have ranges with behavioralsensitivities.

Malleability Dynamic allocation triggers could be manipulated with activity to movethe system into less-desirable configurations.


Dynamic allocations could be used to manipulate the system into less-desirable configurations.

Complacency The existence of allocation plans may make one feel overly secure.


Dynamic allocation control structures could be exploited.

Hard to Manage or Control Dynamic allocations can be difficult to manage as options increase.


It may be hard to predict how the system will operate under differentallocations. It may also be difficult to monitor the system status if theallocations are made automatically and rapidly.

Predictability Even dynamic allocations can be predictable if the decision criteria areknown.

Table A.32

Vulnerabilities That Can Be Incurred from General Management

Primary Cautions

Centrality Many management organizations have strong centralities.

Homogeneity Highly managed organizations tend to be homogeneous and intolerant ofalternative approaches, systems, and designs that introduce additionalmanagement costs and efforts.



Secondary Cautions

Uniqueness Key management functions can be placed with unique components orpeople.


Management controls can introduce limits and fragilities on capabilities.

Rigidity Management systems can be rigid and hard to adapt to new situations.


Rigid, highly structured management systems can be deceived when theirprocesses are well understood by adversaries.

Complacency Detailed management procedures can lead people to believe that thesystems are sufficiently protected.

Predictability Highly structured and micromanaged systems can follow well-knownapproaches. Documentation about these management structures canmake it predictable if it is compromised.

Table A.33

Vulnerabilities That Can Be Incurred from Threat Response Structures and Plans

Primary Cautions

Separability Some response structures disconnect and partition the system in high-threat conditions to protect from attack.

Rigidity Plans might be overly structured and rigid, especially if they applybroadly and do not account for local differences.


Overly structured and rigid plans might be triggered to move the systeminto overly protective states, reducing capability at the low cost oftripping the triggers.

Secondary Cautions

Centrality Some response structures and plans employ centralized monitoring,decisionmaking, and implementation.

Homogeneity Plans might dictate uniform responses across the board rather thanallowing local differences.

Logic/ImplementationErrors; Fallibility

Many plans have never been fully exercised in the real world and maycontain unforeseen difficulties.

DesignSensitivity/Fragility/Limits/Finiteness

Some response actions can limit performance as they seek to protectcritical capabilities.



Complacency The presence of contingency plans can lead to complacency unless theyare often reexamined and expanded.


If care is not taken, the actions taken in the plan can be quite visible andconvey state information.



Predictability If well known, contingency plans can make it easier to predict how thesystem will react to threats and damage.


Table A.34

Vulnerabilities That Can Be Incurred from Rapid Reconstitution and Recovery

Secondary Caution

Complacency The ability to rapidly recover and reconstitute (e.g., reboot) the originalsystem state can make us complacent about failures and compromises ofthe system and give us a false sense of operational capability.

Table A.35

Vulnerabilities That Can Be Incurred from Adaptability and Learning

Secondary Cautions


Adaptive exploration of parameters can temporarily introduce fragilitiesand degraded performance until they are well examined.

Malleability Adaptation algorithms, if known, could be exploited to mislead thesystem.


Adaptation algorithms, if known, could be exploited to mislead thesystem.

Hard to Manage or Control If independent, adaptive systems can be harder to control.


Some adaptive algorithms are hard for humans to understand how theywork.

Table A.36

Vulnerabilities That Can Be Incurred from Immunological Defense Systems

Secondary Cautions

Centrality Some immunological systems rely on centralized information andcoordination sites. Decentralized, peer-to-peer architectures mitigatethis.

Homogeneity Since it is easier to apply this approach to homogeneous components, itsapplication may drive management to more homogeneousconfigurations.

Malleability The automatic update path provides a new means for broad manipulationacross the information system components and must be highlyprotected.

Complacency While valuable and seemingly robust, these systems are not perfect andmust not lead to complacency in other security areas.


The automatic update path provides a new means for broad corruptionsacross the information system components and must be highlyprotected.

Predictability The sharing channel could introduce a means for adversary intelligence.


Table A.37

Vulnerabilities That Can Be Incurred from Vaccination

Secondary Cautions

Homogeneity Because it is easier to apply this approach to homogeneous components,its application may drive management to more homogeneousconfigurations.

Malevolence One must be careful that simulated attacks do not introduce irreparabledamage, introduce new problems, or make it easier for adversaries tounderstand how to attack the system.


One must be careful that simulated attacks do not corrupt the system.

Predictability One must be careful that simulated attacks do not make it easier foradversaries to understand how to attack the system.

Table A.38

Vulnerabilities That Can Be Incurred from Intelligence Operations

Secondary Cautions

Centrality Intelligence information flows are usually centralized to coordinate andexploit the information.

Separability Intelligence activities can make individuals suspicious of each other.

Complacency The existence of an intelligence capability can make us feel more securethan is warranted.

Table A.39

Vulnerabilities That Can Be Incurred from Self-Awareness, Monitoring, and Assessments

Secondary Cautions

Centrality Monitoring the entire system may require a centralized fusion andexploitation capability.

Complacency Large amounts of indigestible information or long periods of falsepositives can make people indifferent.


Our monitors might be exploited by our adversaries.

Table A.40

Vulnerabilities That Can Be Incurred from Deception for ISR

Secondary Cautions

Centrality Effective deceptions often require coordinated planning.

Hard to Manage or Control Deceptions in our own systems can confuse our own managers if they arenot identified.


Deceptions in our own systems can confuse our own managers andcomponents if they are not identified.


Table A.41

Vulnerabilities That Can Be Incurred from Attack Detection, Recognition,Damage Assessment, and Forensics (Self and Foe)

Secondary Cautions

Centrality These assessments may require centralized information sources tofacilitate fusion and other analyses.

Separability Uncertain or faulty detections or conclusions can lead to internalsuspicions, disconnections, and denials of information exchange.

Table A.42

Vulnerabilities That Can Be Incurred from General Counterintelligence

Secondary Cautions

Separability Excessive fears and alarms can make entities suspect one another, andlead to isolation.


Excessive concerns about compromises and intrusions can make thesystem paranoid.


Even counterintelligence efforts can be manipulated.

Hard to Manage or Control Counterintelligence efforts can interfere with regular managementfunctions and controls.

Table A.43

Vulnerabilities That Can Be Incurred from Unpredictable to Adversary

Primary Caution


Unpredictability and complexities can confuse our own managers andcomponents if they are not identified.

Secondary Cautions

Separability Excessive fears and alarms can make entities suspect one another andlead to isolation.


Excessive concerns about compromises and intrusions can make thesystem paranoid.


Even counterintelligence efforts can be manipulated.

Hard to Manage or Control Counterintelligence efforts can interfere with regular managementfunctions and controls.

Table A.44

Vulnerabilities That Can Be Incurred from Deception for CI

Primary Caution


Deceptions can confuse our own managers and components if they arenot identified.



Secondary Cautions

Separability Excessive deceptions can make it hard for entities to know what is real,leading to internal suspicions and isolations.


Excessive deceptions can introduce behavioral anomalies whenlegitimate users are not aware of deceptions.

Hard to Manage or Control Deceptions can interfere with regular management functions andcontrols.

Table A.45

Vulnerabilities That Can Be Incurred from Deterrence

Secondary Cautions

Rigidity Strong threats and penalties can make the system conservative, rigid, andcautious.

Complacency Strong deterrence may naively make the system feel secure.

Predictability Strong threats and penalties can make the system conservative, rigid,cautious, and thus predictable.

Table A.46

Vulnerabilities That Can Be Incurred from Criminal and Legal Penalties and Guarantees

Secondary Caution

Complacency Strong penalties and guarantees can introduce a false sense of security.

Table A.47

Vulnerabilities That Can Be Incurred from Law Enforcement; Civil Proceedings

Secondary Caution

Complacency Strong law enforcement can introduce a false sense of security.

115

BIBLIOGRAPHY

Alberts, Christopher, and Audrey Dorofee, OCTAVESM Threat Profiles, Pittsburgh, Pa.:Carnegie Mellon University, Software Engineering Institute, n.d., www.cert.org/archive/pdf/OCTAVEthreatProfiles.pdf (accessed June 2003).

Alberts, Christopher J., Sandra G. Behrens, Richard D. Pethia, and William R. Wilson,Operationally Critical Threat, Asset, and Vulnerability EvaluationSM (OCTAVESM)Framework, Version 1.0, Pittsburgh, Pa.: Carnegie Mellon University, SoftwareEngineering Institute, CMU/SEI-99-TR-017, June 1999.

Alberts, Christopher J., Audrey J. Dorofee, and Julia H. Allen, OCTAVESM Catalog ofPractices, Version 2.0, Pittsburgh, Pa.: Carnegie Mellon University, Software Engi-neering Institute, CMU/SEI-2001-TR-020, October, 2001.

Anderson, Robert H., Phillip M. Feldman, Scott Gerwehr, Brian K. Houghton, RichardMesic, John Pinder, Jeff Rothenberg, and James R. Chiesa, Securing the U.S.Defense Information Infrastructure: A Proposed Approach, Santa Monica, Calif.:RAND Corporation, MR-993-OSD/NSA/DARPA, 1999.

Common Criteria, Common Criteria for Information Technology Security Evalua-tion—Part 1: Introduction and General Model, CCIMB-99-031, Version 2.1, August1999a.

_______, Common Criteria for Information Technology Security Evaluation—Part 2:Security Function Requirements, CCIMB-99-032, Version 2.1, August 1999b.

_______, Common Criteria for Information Technology Security Evaluation—Part 3:Security Assurance Requirements, CCIMB-99-033, Version 2.1, August 1999c.

_______, Common Criteria for Information Technology Security Evaluation: UserGuide, October 1999d.

_______, Common Methodology for Information Technology Security Evaluation, Part2: Evaluation Methodology, CEM-99/045, Version 1.0, August 1999e.

Dutch Ministry of Transport, Public Works, and Water Management, and Dutch Min-istry of Economic Affairs, Internet Vulnerability, July 2001, www.dgtp.nl/docs/intvul.pdf (accessed June 2003).


Gerwehr, Scott, and Russell W. Glenn, The Art of Darkness: Deception and UrbanOperations, Santa Monica, Calif.: RAND Corporation, MR-1132-A, 2000.

Hamby, Zhi, “What the Heck Is OPSEC?” 2002, at the OPSEC Professionals Societywebpage, www.opsec.org/who (accessed June 2003).

International Organization for Standardization (ISO), Information Technology: Codeof Practice for Information Security Management, ISO/IEC 17799:2000(E), first edi-tion, Geneva, Switzerland, December 1, 2000.

Joint Chiefs of Staff, Command and Control for Joint Air Operations, Joint Publication3-56.1, November 14, 1994, www.adtdl.army.mil/cgi-bin/atdl.dll/jt/3-56_1/3-56_1toc.htm (accessed June 2003).

_______, Joint Doctrine for Operations Security, Joint Publication 3-54, January 24,1997.

_______, DoD Dictionary of Military and Associated Terms, Joint Publication 1-02,June 5, 2003 (last update), http://www.dtic.mil/doctrine/jel/doddict/.

Kent, Glenn A., and William E. Simons, “Objective-Based Planning,” in Paul K. Davis,ed., New Challenges for Defense Planning: Rethinking How Much Is Enough, SantaMonica, Calif.: RAND Corporation, MR-400-RC, 1994, pp. 59–71.

Lewis, Leslie, and C. Robert Roll, Strategy-to-Tasks: A Methodology for Resource Allo-cation and Management, Santa Monica, Calif.: RAND Corporation, P-7839, 1993.

Minehart, Robert F., Jr., “Information Warfare Tutorial,” Army War College, 1998,at http://carlisle-www.army.mil/usacsl/divisions/std/branches/iw/tutorial/intro.htm (accessed June 2003).

Thaler, David E., Strategies to Tasks: A Framework for Linking Means and Ends, SantaMonica, Calif.: RAND Corporation, MR-300-AF, 1993.

U.S. Army Communications Electronics Command, OPSEC Primer, Fort Monmouth,N.J.: Software Engineering Center (SEC) Security Office, June 27, 1999.

U.S. Department of the Air Force, “Operational Risk Management,” Air ForceInstruction 90-901, April 1, 2000a.

_______, “Operational Risk Management,” Air Force Policy Directive 90-9, April 1,2000b.

_______, “Operational Risk Management (ORM) Guidelines and Tools,” Air ForcePamphlet 90-902, December 14, 2000c.

U.S. Department of the Army, Headquarters, Army Regulation 530-1, OperationsSecurity (OPSEC), Washington, D.C.: U.S. Government Printing Office, unclassi-fied, distribution limited, March 3, 1995.

U.S. Naval Safety Center, “Operational Risk Management (ORM),” OPNAV Instruc-tion 3500.39A/Marine Corps Order 3500.27A, July 1997.

Bibliography 117

_______, “Introduction to Operational Risk Management,” Naval Safety Center, n.d.,www.safetycenter.navy.mil/orm/generalorm/introduction/default.htm (accessedJune 2003).

_______, “Operational Risk Management” (webpage), www.safetycenter.navy.mil/orm/default.htm (accessed June 2003).

Williams, Gary, “Operations Security (OPSEC),” Ft. Leavenworth, Kan.: Center forArmy Lessons Learned, 1999, http://call.army.mil/products/trngqtr/tq3-99/opsec.htm (accessed June 2003).

finding and fixing vulnerabilities in information systems vulnerability the assessment … ·...

Documents